CVE-2026-22773
📋 TL;DR
This vulnerability allows remote attackers to crash vLLM servers running multimodal models with Idefics3 vision implementation by sending a specially crafted 1x1 pixel image. The tensor dimension mismatch causes an unhandled runtime error that terminates the entire server. Organizations using vLLM versions 0.6.4 through 0.11.x for serving multimodal models are affected.
💻 Affected Systems
- vLLM
📦 What is this software?
Vllm by Vllm
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for all users of the vLLM service, requiring manual server restart and potentially disrupting critical AI inference workloads.
Likely Case
Service disruption and downtime for vLLM-powered applications, requiring administrator intervention to restart crashed servers.
If Mitigated
Minimal impact with proper monitoring and automated restart mechanisms in place, though service interruptions may still occur.
🎯 Exploit Status
Exploitation requires sending a specially crafted 1x1 pixel image to the vulnerable endpoint. No authentication is required if the service is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.12.0
Vendor Advisory: https://github.com/vllm-project/vllm/security/advisories/GHSA-grg2-63fw-f2qr
Restart Required: Yes
Instructions:
1. Upgrade vLLM to version 0.12.0 or later using pip: pip install vllm>=0.12.0
2. Restart all vLLM servers and services
3. Verify the upgrade was successful
🔧 Temporary Workarounds
Input Validation Filter
allImplement pre-processing to reject or resize 1x1 pixel images before they reach the vLLM engine
Process Monitoring and Auto-restart
linuxConfigure monitoring to automatically restart vLLM processes if they crash
# Example using systemd (Linux)
[Service]
Restart=always
RestartSec=5
🧯 If You Can't Patch
- Implement network-level filtering to block or rate-limit image uploads to vLLM endpoints
- Deploy vLLM behind a reverse proxy with request size limits and input validation
🔍 How to Verify
Check if Vulnerable:
Check vLLM version: python -c "import vllm; print(vllm.__version__)" and verify if between 0.6.4 and 0.11.xCheck Version:
python -c "import vllm; print(vllm.__version__)"Verify Fix Applied:
Confirm version is 0.12.0 or higher and test with a 1x1 pixel image to ensure server doesn't crash📡 Detection & Monitoring
Log Indicators:
- RuntimeError related to tensor dimension mismatch
- Unexpected vLLM process termination
- Error messages containing 'Idefics3' or 'vision model'
Network Indicators:
- Multiple requests with small image files (especially 1x1 pixel)
- Sudden drop in service availability
SIEM Query:
source="vllm.log" AND ("RuntimeError" OR "tensor dimension" OR "process terminated")