CVE-2026-73557

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
vllm-project	vllm	>= 0.20.2rc0, < 0.26.0

References

https://github.com/vllm-project/vllm/commit/793cf79c89d4049124e756915468ac30318f2e50Patch
https://github.com/vllm-project/vllm/pull/48583Issue Tracking, Patch
https://github.com/vllm-project/vllm/releases/tag/v0.26.0Release Notes
https://github.com/vllm-project/vllm/security/advisories/GHSA-pr7f-p5mw-fc87Mitigation, Vendor Advisory

Timeline

Published: Aug 13, 2026
Last modified: Oct 15, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-735585.3vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_CVE-2026-735596.5vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt fi CVE-2026-73568.8Use after free in Navigation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via a crafted HTML CVE-2026-735606.5vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_u CVE-2026-735617.5Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection trigg CVE-2026-735626.5Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, pas CVE-2026-735636.1Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID m CVE-2026-735648.7frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel req CVE-2026-735655.3@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocke CVE-2026-735667.5node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas CVE-2026-735679.1sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argu CVE-2026-735687.5py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/st