{"data":{"id":"65eef340-4948-4271-88d8-a92c8345ca45","title":"CVE-2026-22773: vLLM is an inference and serving engine for large language models (LLMs). In versions from 0.6.4 to before 0.12.0…","summary":"CVE-2026-22773 affects vLLM, an inference and serving engine for large language models, in versions from 0.6.4 before 0.12.0. A specially crafted 1x1 pixel image sent to a server running multimodal models that use the Idefics3 vision model implementation causes a tensor dimension mismatch. The resulting unhandled runtime error terminates the whole server.","solution":"This issue has been patched in version 0.12.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22773","publishedAt":"2026-01-10T12:16:03.527Z","cveId":"CVE-2026-22773","cweIds":["CWE-770"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.6.4, < 0.12.0 (fixed: 0.12.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM","Idefics3"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM engine crash via crafted 1x1 pixel image in Idefics3 multimodal models","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00442,"epssCheckedAt":"2026-11-04T06:10:15.713Z","kevDateAdded":null,"advisoryAliases":["GHSA-grg2-63fw-f2qr"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:25.428Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-12-03T11:37:24.522Z","daysToFix":-38,"fixCheckedAt":"2026-10-29T21:42:09.741Z","capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.12.0","matchedVersion":"0.12.0","fixReleasedAt":"2025-12-03T11:37:24.522Z","daysToFix":-38,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:42:09.589Z"}]}}