CVE-2026-73557: vLLM concurrent prompt-embedding guard bypass

CVE-2026-73557 · Severity: medium · CVSS 5.3 · Published 2026-08-13

vLLM is a large language model serving engine that supports optional client-submitted embedding inputs for chat completions. The safeguard added for a prior vulnerability (CVE-2025-62164) uses a process-global PyTorch flag to validate sparse tensors. When two embedding requests are processed concurrently on the event loop's default threads, one request can exit its guard and restore the flag to disabled state while another request is still executing inside the guard, allowing invalid tensor data to bypass validation and potentially crash the service or corrupt memory.

Technologies: vllm (PyPI), Vllm. Vendors: PyPI, Vllm.

Quick answers

Is CVE-2026-73557 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73557 being exploited in the wild.
How severe is CVE-2026-73557?
Medium severity, with a CVSS score of 5.3, published 13 August 2026.
Which products and versions are affected?
vllm (PyPI) ECOSYSTEM:introduced=0.21.0,fixed=0.26.0.
Is there a fix for CVE-2026-73557?
Yes. vllm (PyPI): upgrade to 0.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73557 attacked?
It is attacked over the network.
Am I affected by CVE-2026-73557?
Check whether you run vllm (PyPI) or Vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vllm (PyPI): upgrade to 0.26.0 or later
    pip install "vllm>=0.26.0"

Technical details

The vulnerability is a race condition in PyTorch's `torch.sparse.check_sparse_tensor_invariants()` context manager, which manipulates a process-global flag via save/enable/restore operations. The `safe_load_prompt_embeds` function in vLLM wraps client-controlled serialized tensor deserialization in this context to validate sparse tensors before calling `to_dense()`. When two prompt-embedding content parts from the same `/v1/chat/completions` request run concurrently on distinct default-executor threads (via `asyncio.gather`), the interleaving can cause one context to exit and restore the global flag to `False` before the other context reaches `torch.load()`, causing the second loader to execute with the invariant check disabled. An attacker can then supply a malformed sparse tensor (invalid indices `[[10], [10]]` for declared shape `[3, 3]`) that would normally be rejected but is reconstructed when the invariant is disabled, reaching the `to_dense()` call with an invalid object. The feature requires `--enable-prompt-embeds` (default-off), and API authentication is optional (middleware installed only when keys are configured). Patch available in version 0.26.0; immediate workaround is to keep `enable_prompt_embeds` disabled.

Affected products

  • vLLM Project vLLM >=0.21.0, <0.26.0

Identifiers

  • CVE-2026-73557
  • GHSA-pr7f-p5mw-fc87
  • PYSEC-2026-3938

Timeline

  • 2026-07-27: disclosed
  • 2026-09-04: advisory: Published as CVE-2026-73557 / GHSA-pr7f-p5mw-fc87
  • 2026-09-04: patched: Fixed in vLLM 0.26.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.