Database/AI/ML frameworks & serving
vLLM: text prompts spelling multimodal placeholder tokens crash the worker
Impact
vLLM 0.6.1 through 0.19.x treats special tokens spelled out in plain text prompts as control tokens. A prompt with image or video placeholder sequences but no matching media makes vLLM index into empty grids while computing input positions. The resulting unhandled IndexError terminates the worker or degrades availability. Models served through multimodal paths that use image_grid_thw/video_grid_thw are affected. On a shared inference endpoint one request can take down the serving process for every user of that model, and reloading a large model onto its GPUs takes real time.
Who can reach it
Anyone who can send a text prompt to a vLLM endpoint serving an affected multimodal model. No authentication is needed beyond whatever the deployment puts in front of the API.
What to do
Upgrade vLLM to 0.20.0 and restart the serving pods or processes. Each restart reloads the model onto its GPUs. Until then, filtering or rejecting prompts that contain literal multimodal placeholder tokens at the gateway reduces exposure. The advisory does not prescribe this, so verify it against your model's tokenizer.
References
Related entries
- NVIDIA Triton Inference Server: missing authorization lets an unauthenticated caller reach protected operationsCVE-2026-47625 · NVIDIA Triton Inference Server for Linux (authorization check)High
- Spring AI: predictable ONNX model cache path lets a local user plant a substitute model fileCVE-2026-47852 · Spring AI (ONNX model cache path)High
- MKP Kubernetes MCP server: unauthenticated log request exhausts server memoryCVE-2026-50125 · MKP (Kubernetes MCP server, get_resource pod-logs subresource)High
- llama.cpp: uncontrolled recursion in JSON-schema-to-grammar conversion crashes the serverCVE-2026-52130 · llama.cpp (common/json-schema-to-grammar.cpp)High
- vLLM: unauthenticated video/jpeg data URL with unbounded frame count exhausts server memoryCVE-2026-5497 · vLLM (VideoMediaIO.load_base64 frame count limit)High
- Ollama (quantization engine): Unauthenticated remote information disclosure — reads and exfiltrates model dataCVE-2026-5757 · Ollama (quantization engine)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.