---
id: CVE-2026-44222
title: >-
  vllm: vLLM: Denial of Service via malformed multimodal input or token
  injection (CVE-2026-44222)
summary: >-
  A flaw was found in vLLM, an inference and serving engine for large language
  models (LLMs). This vulnerability allows unauthenticated attackers to cause a
  Denial of Service (DoS) by supplying image or video placeholder sequences
  without ma…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-1285
vendor: Red Hat
product: Red Hat Enterprise Linux AI (RHEL AI) 3
affected:
  - ai_inference_server
  - enterprise_linux_ai_rhel_ai 3
  - openshift_ai_rhoai
  - ai_inference_server 3.2
  - ai_inference_server 3.3
patched:
  - ai_inference_server 3.2
  - ai_inference_server 3.3
published: '2026-05-12'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T19:19:13+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44222.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44222.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44222'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2476840'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44222'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44222'
  - url: 'https://github.com/vllm-project/vllm/issues/32656'
  - url: >-
      https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f
  - url: 'https://access.redhat.com/errata/RHSA-2026:61627'
  - url: 'https://access.redhat.com/errata/RHSA-2026:61629'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60363'
  - url: 'https://github.com/advisories/GHSA-hpv8-x276-m59f'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3409.yaml
  - url: 'https://github.com/vllm-project/vllm'
  - url: 'https://pypi.org/project/vllm'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00414
epssPercentile: 0.35493
aliases:
  - GHSA-hpv8-x276-m59f
  - PYSEC-2026-3409
ecosystem: pip
scores:
  vendor: 7.5
  osv: 6.5
ingestedAt: '2026-07-13T18:57:59.318Z'
---

## Overview

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) by supplying image or video placeholder sequences without matching data, leading to an unhandled error and worker termination. Additionally, text-only prompts containing special tokens can be misinterpreted as control commands, potentially leading to unexpected behavior.

## Vendor advisories

- **RHSA-2026:61627** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61627)
- **RHSA-2026:61629** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61629)
- **RHSA-2026:60363** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60363)
- **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3 · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44222.json)

**vllm: vLLM: Denial of Service via malformed multimodal input or token injection** — rated Important by Red Hat. Released 2026-05-12, updated 2026-10-02.

Affected:

- Red Hat AI Inference Server
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)

Fixed:

- Red Hat AI Inference Server 3.2
- Red Hat AI Inference Server 3.3

No fix planned:

- Red Hat AI Inference Server
- Red Hat OpenShift AI (RHOAI)
- Red Hat Enterprise Linux AI (RHEL AI) 3

Not affected:

- Red Hat OpenShift AI (RHOAI)

## Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:61627 https://access.redhat.com/errata/RHSA-2026:61627
For more information visit https://access.redhat.com/errata/RHSA-2026:61629 https://access.redhat.com/errata/RHSA-2026:61629
For more information visit https://access.redhat.com/errata/RHSA-2026:60363 https://access.redhat.com/errata/RHSA-2026:60363

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

## Package advisory (CVE-2026-44222)

Affected packages:

- `vllm >= 0.6.1, < 0.20.0`

Patched in:

- `vllm 0.20.0`

Source: https://osv.dev/vulnerability/GHSA-hpv8-x276-m59f