Описание
vLLM Vulnerable to Remote DoS via Special-Token Placeholders
Summary
This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. Severity: High (remote DoS). Reproduced on vLLM 0.10.0 with Qwen2.5-VL.
Details
- Affected component: multimodal input position computation.
- File/functions (paths are indicative):
- vllm/model_executor/layers/rotary_embedding.py
- get_input_positions_tensor(...)
- _vl_get_input_positions_tensor(...)
- vllm/model_executor/layers/rotary_embedding.py
- Failure mechanism:
- The code counts detected vision tokens and then indexes video_grid_thw/image_grid_thw accordingly.
- When user input carries placeholder tokens but no actual multimodal payload, these grids are empty. The code does not bounds-check before indexing.
Representative snippet (context):
Abbreviated call path:
PoC
Environment
- vLLM: 0.10.0
- Model: Qwen/Qwen2.5-VL-3B-Instruct
- Launch server:
Request (text-only, no image/video data)
Observed result
- HTTP 500; logs show IndexError: list index out of range from _vl_get_input_positions_tensor(...).
- In some deployments, the worker exits and capacity remains reduced until manual restart.
Impact
- Type: Token Injection leading to Remote Denial of Service (unauthenticated). A single request can trigger the fault.
- Scope: Any vLLM deployment that serves VLMs and accepts raw user text via OpenAI-compatible endpoints (self-hosted or proxied/managed fronts).
- Effect: Request → unhandled exception in position computation → worker termination / service unavailability.
Fixes
- Changes associated with https://github.com/vllm-project/vllm/issues/32656
Credits
Pengyu Ding (Infra Security, Ant Group)
Ziteng Xu (Infra Security, Ant Group)
Ссылки
- https://github.com/vllm-project/vllm/security/advisories/GHSA-hpv8-x276-m59f
- https://nvd.nist.gov/vuln/detail/CVE-2026-44222
- https://github.com/vllm-project/vllm/issues/32656
- https://github.com/advisories/GHSA-hpv8-x276-m59f
- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3409.yaml
- https://pypi.org/project/vllm
Пакеты
vllm
>= 0.6.1, < 0.20.0
0.20.0
Связанные уязвимости
vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. This vulnerability is fixed in 0.20.0.
vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. This vulnerability is fixed in 0.20.0.
vLLM is an inference and serving engine for large language models (LLM ...