GHSA-hpv8-x276-m59f: vLLM Vulnerable to Remote DoS via Special-Token Placeholders

Summary

Unauthenticated text-only prompts in vLLM that spell special tokens such as <|image_pad|> are interpreted as control tokens. When image or video placeholders arrive without matching data, get_input_positions_tensor in vllm/model_executor/layers/rotary_embedding.py indexes empty image_grid_thw/video_grid_thw grids without a bounds check, raising an unhandled IndexError that can terminate the worker. Reproduced on vLLM 0.10.0 with Qwen2.5-VL; a single request can trigger it.

Mitigation

Fixes: Changes associated with https://github.com/vllm-project/vllm/issues/32656

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• vllmPyPILLM dependency since 2023-08-25 · 14 tracked dependents

Topics

• Inference infrastructure

Related items

• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
• MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
• CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database
• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence