CVE-2026-44222

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

May 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.41% · Oct 25, 2026

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) by supplying image or video placeholder sequences without matching data, leading to an unhandled error and worker termination. Additionally, text-only prompts containing special tokens can be misinterpreted as control commands, potentially leading to unexpected behavior. vllm: vLLM: Denial of Service via malformed multimodal input or token injection This is an Important denial of service vulnerability affecting vLLM, as integrated into Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI. The flaw allows unauthenticated attackers to trigger worker termination and degrade service availability by submitting malformed multimodal input or text prompts containing specific token sequences. This impact is significant due to the potential for service disruption in AI inference workloads. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.