CVE-2026-22773: 
NixOS vulnerability analysis and mitigation

CVE-2026-22773 is a Denial of Service (DoS) vulnerability in vLLM, an inference and serving engine for large language models (LLMs), affecting versions 0.6.4 through 0.11.x (before 0.12.0). An authenticated attacker can crash the vLLM engine serving multimodal models that use the Idefics3 vision model implementation by sending a specially crafted 1×1 pixel image, causing a tensor dimension mismatch and complete server termination. The vulnerability was published on January 9, 2026, by researcher oxcabe and patched in version 0.12.0. It carries a CVSS v3.1 base score of 6.5 (Moderate), requiring low privileges and no user interaction (Github Advisory, vLLM Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and stems from improper handling of ambiguous image dimensions in vllm/model_executor/models/idefics3.py. When the image processor receives a 1×1 pixel image with shape (1, 1, 3) in HWC (Height, Width, Channel) format, it incorrectly interprets it as CHW (Channel, Height, Width) format with shape (3, H, W), leading to an erroneous calculation of the number of image patches. At line 672, the split() call fails with RuntimeError: split_with_sizes expects split_sizes to sum exactly to 9 (input tensor's size at dimension 0), but got split_sizes=[17], which is unhandled and terminates the EngineCore process. The attack requires only network access and low privileges (e.g., API access to the vLLM endpoint), with no user interaction needed (Github Advisory, vLLM Advisory).

Successful exploitation results in a complete denial of service — the vLLM EngineCore process terminates entirely, disrupting availability of the LLM inference service for all users. There is no impact on confidentiality or data integrity; the attack is purely availability-focused. Any model using the Idefics3 architecture is affected, including HuggingFaceTB/SmolVLM-Instruct, and repeated exploitation could keep the service permanently unavailable without automated restart mechanisms (Github Advisory, vLLM Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.018% (0.04% per Feedly), placing it in the 5th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation probability, the attack is straightforward for any authenticated API user, requiring only the ability to submit a crafted image to a vulnerable multimodal endpoint.

1. Reconnaissance: Identify vLLM inference endpoints serving multimodal models (e.g., via API documentation, exposed ports, or service banners). Confirm the target is running vLLM version 0.6.4–0.11.x with an Idefics3-based model such as HuggingFaceTB/SmolVLM-Instruct.
2. Obtain API access: Acquire valid credentials or an API token with at least low-privilege access to the vLLM inference endpoint (e.g., a standard user account).
3. Craft malicious image: Create a 1×1 pixel image with shape (1, 1, 3) in HWC format. This can be done trivially with any image library (e.g., Python Pillow: Image.new('RGB', (1, 1))), saved as a standard image file (PNG, JPEG, etc.).
4. Submit crafted request: Send the 1×1 pixel image as part of a multimodal inference request to the vLLM API endpoint targeting an Idefics3-based model.
5. Trigger crash: The image processor misinterprets the image format, computes an incorrect num_patches value, and the split() call raises an unhandled RuntimeError, terminating the EngineCore process and crashing the server (Github Advisory, vLLM Advisory).

• Logs: Unhandled RuntimeError in vLLM server logs referencing split_with_sizes with a message such as split_with_sizes expects split_sizes to sum exactly to 9 (input tensor's size at dimension 0), but got split_sizes=[17]; sudden EngineCore process termination entries in application logs.
• Process: Unexpected termination of the vLLM EngineCore process; absence of the vLLM serving process after previously being active.
• Network: Repeated API requests to multimodal inference endpoints containing very small (1×1 pixel) image payloads from the same source IP, particularly targeting Idefics3-based model endpoints.
• File System: Core dump files generated by the crashed vLLM process, if core dumps are enabled on the host system.

Upgrade vLLM to version 0.12.0 or later, which contains the official patch for this vulnerability (Github Advisory). For organizations unable to patch immediately, implement network-level access controls to restrict which authenticated users can submit requests to vLLM multimodal inference endpoints, and add input validation to reject images below a minimum dimension threshold. Additionally, wrapping the split() call in a try/except block to catch RuntimeError and raise a graceful InvalidImageError instead of crashing the server is a viable interim code-level workaround (vLLM Advisory).

The vulnerability was reported by researcher oxcabe, with remediation developed by Isotr0py and reviewed by DarkLight1337 from the vLLM project (vLLM Advisory). Red Hat issued a security errata (RHSA-2026:3462) addressing this CVE, indicating enterprise Linux distribution impact. A Medium article on vLLM production security hardening for enterprise deployments referenced this vulnerability as part of broader guidance on securing LLM inference infrastructure.