CVE-2026-44222
Fixed in a distro release EPSS <1%CVSS 6.5
vLLM is an inference and serving engine for large language models (LLMs). From 0.6.1 to before 0.20.0, there is a a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image_grid_thw/video_grid_thw are affected. This vulnerability is fixed in 0.20.0.
Products: vllm-project vllm
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | vllm | 0.20.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | lmcache-cuda-12.8 | no fix |
| Chainguard | py3.10-vllm-cuda-12.4 | no fix |
| Chainguard | py3.10-vllm-cuda-12.9 | no fix |
| Chainguard | py3.12-vllm-cuda-12.4 | no fix |
| Chainguard | py3.12-vllm-cuda-12.9 | no fix |
| Chainguard | py3.13-vllm-cuda-12.9 | no fix |
| Chainguard | tritonserver-backend-vllm-cuda-12.9 | no fix |
| Chainguard | tritonserver-backend-vllm-cuda-13.0 | 25.11-r7 |
| Chainguard | vllm-openai-cuda-12.9 | 0.28.0-r0 |
| Chainguard | vllm-openai-cuda-12.9-nvidia-cusparse | no fix |