EUVD-2026-1865

vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions...

vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions

Summary Users can crash the vLLM engine serving multimodal models that use the Idefics3 vision model implementation by sending a specially crafted 1x1 pixel image. This causes a tensor dimension mismatch that results in an unhandled runtime error, leading to complete server termination. Details T...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processimageinput in the idefics3 model implementation. An attacker can cause the server...

CVE-2026-22773

CVE-2026-22773 affects vLLM (inference/serving engine) versions 0.6.4 through before 0.12.0 that serve multimodal models using the Idefics3 vision model. A crafted 1x1 pixel image triggers a tensor dimension mismatch in the image input processing, causing an unhandled runtime error and enabling a...