# CVE-2026-73557: vLLM concurrent prompt-embedding guard bypass

Source: https://junglewise.ai/threats/cve-2026-73557-vllm-concurrent-prompt-embedding-guard-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73557 · Severity: medium · CVSS 5.3 · Published 2026-08-13

vLLM is a large language model serving engine that supports optional client-submitted embedding inputs for chat completions. The safeguard added for a prior vulnerability (CVE-2025-62164) uses a process-global PyTorch flag to validate sparse tensors. When two embedding requests are processed concurrently on the event loop's default threads, one request can exit its guard and restore the flag to disabled state while another request is still executing inside the guard, allowing invalid tensor data to bypass validation and potentially crash the service or corrupt memory.

Technologies: [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm), [Vllm](https://junglewise.ai/threats/technologies/vllm). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Vllm](https://junglewise.ai/threats/vendors/vllm).

## Quick answers

**Is CVE-2026-73557 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73557 being exploited in the wild.

**How severe is CVE-2026-73557?** Medium severity, with a CVSS score of 5.3, published 13 August 2026.

**Which products and versions are affected?** vllm (PyPI) ECOSYSTEM:introduced=0.21.0,fixed=0.26.0.

**Is there a fix for CVE-2026-73557?** Yes. vllm (PyPI): upgrade to 0.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73557 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73557?** Check whether you run vllm (PyPI) or Vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vllm (PyPI): upgrade to 0.26.0 or later

  ```sh
  pip install "vllm>=0.26.0"
  ```


## Technical details

The vulnerability is a race condition in PyTorch's `torch.sparse.check_sparse_tensor_invariants()` context manager, which manipulates a process-global flag via save/enable/restore operations. The `safe_load_prompt_embeds` function in vLLM wraps client-controlled serialized tensor deserialization in this context to validate sparse tensors before calling `to_dense()`. When two prompt-embedding content parts from the same `/v1/chat/completions` request run concurrently on distinct default-executor threads (via `asyncio.gather`), the interleaving can cause one context to exit and restore the global flag to `False` before the other context reaches `torch.load()`, causing the second loader to execute with the invariant check disabled. An attacker can then supply a malformed sparse tensor (invalid indices `[[10], [10]]` for declared shape `[3, 3]`) that would normally be rejected but is reconstructed when the invariant is disabled, reaching the `to_dense()` call with an invalid object. The feature requires `--enable-prompt-embeds` (default-off), and API authentication is optional (middleware installed only when keys are configured). Patch available in version 0.26.0; immediate workaround is to keep `enable_prompt_embeds` disabled.

## Affected products

- vLLM Project vLLM >=0.21.0, <0.26.0

## Identifiers

- CVE-2026-73557
- GHSA-pr7f-p5mw-fc87
- PYSEC-2026-3938

## Timeline

- 2026-07-27: disclosed
- 2026-09-04: advisory: Published as CVE-2026-73557 / GHSA-pr7f-p5mw-fc87
- 2026-09-04: patched: Fixed in vLLM 0.26.0

## References

- [https://api.github.com/users/hexcraft-labs](https://api.github.com/users/hexcraft-labs)
- [https://github.com/hexcraft-labs](https://github.com/hexcraft-labs)
- [https://api.github.com/users/hexcraft-labs/gists%7B/gist_id%7D](https://api.github.com/users/hexcraft-labs/gists%7B/gist_id%7D)
- [https://api.github.com/users/hexcraft-labs/repos](https://api.github.com/users/hexcraft-labs/repos)
- [https://avatars.githubusercontent.com/u/302526581?v=4](https://avatars.githubusercontent.com/u/302526581?v=4)
- [https://api.github.com/users/hexcraft-labs/events%7B/privacy%7D](https://api.github.com/users/hexcraft-labs/events%7B/privacy%7D)

## Related threats

- [vLLM chat template resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-115918-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://junglewise.ai/threats/cve-2026-115917-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM off-by-one error in tokenizer max_token_id validation](https://junglewise.ai/threats/cve-2026-115916-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM image format validation bypass in media processing](https://junglewise.ai/threats/cve-2026-115915-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM denial of service in DeepSeek-OCR image processing](https://junglewise.ai/threats/cve-2026-115914-vllm-is-an-inference-and-serving-engine-for-large-language)