CVE-2026-73557
Received Received - Intake

Sparse Tensor Validation Bypass in vLLM

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73557
EUVD
EUVD-2026-58064

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
vllm vllm to 0.26.0 (inc)
vllm vllm 0.26.0
vllm_project vllm to 0.26.0 (inc)
vllm_project vllm 0.26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in vLLM's sparse tensor validation. It allows malicious tensors to bypass security checks due to concurrent access to a global flag used by PyTorch's sparse tensor integrity checks. The issue occurs when prompt embedding parts are processed simultaneously, enabling invalid tensors to reach tensor conversion despite prior protections.

Detection Guidance

Detecting this vulnerability requires checking if your vLLM version is between 0.20.2rc0 and 0.26.0. Run: vllm --version. If the version is within this range, the system is vulnerable. Additionally, check if --enable-prompt-embeds is enabled in your vLLM configuration or startup commands.

Impact Analysis

If exploited, this could allow attackers to load maliciously crafted sparse tensors that bypass validation, potentially leading to crashes, memory corruption, or unintended behavior in systems using vLLM. The impact depends on the original CVE-2025-62164's behavior, as this is a bypass of its remediation.

Mitigation Strategies

Upgrade vLLM to version 0.26.0 or later. If upgrading is not immediately possible, disable the --enable-prompt-embeds flag in your vLLM configuration. Ensure no concurrent prompt embedding parts are processed by default executor until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73557. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart