{"items":[{"id":"NVI-00020085","kind":"vulnerability","title":"vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-grg2-63fw-f2qr","CVE-2026-22773"],"plain_summary":"GitHub lists this reviewed advisory for vllm. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7458f590d9c13bb9a917ecaddaa9bcee"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-08T19:52:29.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-7458f590d9c13bb9a917ecaddaa9bcee"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7458f590d9c13bb9a917ecaddaa9bcee","url":"https://github.com/advisories/GHSA-grg2-63fw-f2qr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-grg2-63fw-f2qr","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:51:53.608Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7458f590d9c13bb9a917ecaddaa9bcee"],"technology":"vllm","known_exclusions":[],"conditions_summary":"### Summary\nUsers can crash the vLLM engine serving multimodal models that use the _Idefics3_ vision model implementation by sending a specially crafted 1x1 pixel image. This causes a tensor dimension mismatch that results in an unhandled runtime error, leading to complete server termination.\n\n### Details\nThe vulnerability is triggered when the image processor encounters a 1x1 pixel image with shape (1, 1, 3) in HWC (Height, Width, Channel) format. Due to the ambiguous dimensions, the processor incorrectly assumes the image is in CHW (Channel, Height, Width) format with shape (3, H, W). This misinterpretation causes an incorrect calculation of the number of image patches, resulting in a fatal tensor split operation failure.\n\n**Crash location**: `vllm/model_executor/models/idefics3.py` line 672:\n```python\ndef _process_image_input(self, image_input: ImageInputs) -> torch.Tensor | list[torch.Tensor]:\n    # ...\n    num_patches = image_input[\"num_patches\"]\n    return [e.flatten(0, 1) for e in image_features.split(num_patches.tolist())]\n```\n\nThe `split()` call fails because the computed `num_patches` value (17) does not match the actual tensor dimension (9):\n```\nRuntimeError: split_with_","public_affected_ranges":[">= 0.6.4, < 0.12.0"]}],"null_published_at":"2026-11-08T15:11:49.346Z","source_updated_at":"2026-06-08T19:52:29.000Z","source_disclosed_at":"2026-01-13T18:44:15.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:51:53.608Z"}],"next_cursor":null,"snapshot_revision":"42594"}