Executive brief
vLLM is a large language model serving engine that supports optional client-submitted embedding inputs for chat completions. The safeguard added for a prior vulnerability (CVE-2025-62164) uses a process-global PyTorch flag to validate sparse tensors. When two embedding requests are processed concurrently on the event loop's default threads, one request can exit its guard and restore the flag to disabled state while another request is still executing inside the guard, allowing invalid tensor data to bypass validation and potentially crash the service or corrupt memory.
Technical details
The vulnerability is a race condition in PyTorch's `torch.sparse.check_sparse_tensor_invariants()` context manager, which manipulates a process-global flag via save/enable/restore operations. The `safe_load_prompt_embeds` function in vLLM wraps client-controlled serialized tensor deserialization in this context to validate sparse tensors before calling `to_dense()`. When two prompt-embedding content parts from the same `/v1/chat/completions` request run concurrently on distinct default-executor threads (via `asyncio.gather`), the interleaving can cause one context to exit and restore the global flag to `False` before the other context reaches `torch.load()`, causing the second loader to execute with the invariant check disabled. An attacker can then supply a malformed sparse tensor (invalid indices `[[10], [10]]` for declared shape `[3, 3]`) that would normally be rejected but is reconstructed when the invariant is disabled, reaching the `to_dense()` call with an invalid object. The feature requires `--enable-prompt-embeds` (default-off), and API authentication is optional (middleware installed only when keys are configured). Patch available in version 0.26.0; immediate workaround is to keep `enable_prompt_embeds` disabled.
Affected products
- vLLM Project vLLM >=0.21.0, <0.26.0
Timeline
- 2026-07-27: disclosed
- 2026-09-04: advisory: Published as CVE-2026-73557 / GHSA-pr7f-p5mw-fc87
- 2026-09-04: patched: Fixed in vLLM 0.26.0
References
- https://api.github.com/users/hexcraft-labs
- https://github.com/hexcraft-labs
- https://api.github.com/users/hexcraft-labs/gists%7B/gist_id%7D
- https://api.github.com/users/hexcraft-labs/repos
- https://avatars.githubusercontent.com/u/302526581?v=4
- https://api.github.com/users/hexcraft-labs/events%7B/privacy%7D