vLLM ist anfällig für DoS in Idefics3 Vision-Modellen über Bild-Payloads mit mehrdeutigen Dimensionen

The primary impact of CVE-2026-22773 is a complete denial of service. A malicious actor can easily trigger the vulnerability by sending a small, specially crafted image. This results in an unhandled runtime error due to a tensor dimension mismatch, causing the vLLM server to crash. The blast radius is limited to the affected vLLM server instance; however, this can disrupt critical applications relying on the LLM inference service. While no direct data exfiltration is possible through this vulnerability, the disruption of service can indirectly impact data availability and processing pipelines. The simplicity of triggering the vulnerability makes it a high-impact concern, particularly in environments with exposed LLM inference endpoints.

Organizations and developers deploying vLLM for LLM inference and serving, particularly those utilizing multimodal models with the Idefics3 vision model, are at risk. Services that rely on vLLM for real-time inference or critical applications are especially vulnerable to the disruption caused by a denial-of-service attack.

• python / server: Monitor vLLM server logs for errors related to tensor dimension mismatches or runtime exceptions during image processing.

# Example: Check for specific error messages in the logs
import re
with open('vllm.log', 'r') as f:
    for line in f:
        if re.search(r'tensor dimension mismatch', line):
            print('Potential CVE-2026-22773 exploit attempt detected!')

1. 2026-01-13Disclosure

   disclosure

1. Reserviert2026-01-09
2. Veröffentlicht2026-01-13
3. Geändert2026-03-27
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22773 is to upgrade vLLM to version 0.12.0 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing input validation on the image processing pipeline to reject images with dimensions that trigger the vulnerability. Specifically, block images with a size of 1x1 pixels. Additionally, consider rate limiting requests to the inference endpoint to mitigate potential DoS attacks. After upgrading, confirm the fix by attempting to send the triggering 1x1 pixel image and verifying that the server does not crash.