vLLM missing tensor validation in multimodal embeddings

Severity: high · CVSS 8.8 · Published 2026-06-20

vLLM is a large language model serving framework widely used for deploying AI models. The prompt-embeds feature in vLLM versions 0.10.2 through 0.13.0 fails to properly validate tensor data submitted by users, allowing attackers to crash the service or corrupt memory with specially crafted requests. While the feature is disabled by default, organizations that enable it for multimodal embedding support face high risk of service outages or potential code execution if an attacker gains access to send embedding requests.

Technologies: Vllm. Vendors: Vllm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.8, published 20 June 2026.
Which products and versions are affected?
Vllm >=0.10.2, <0.13.0.
Is there a fix for This vulnerability?
A patch was published on 2026-01-08: Fix available in vLLM 0.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing input validation flaw (CWE-20) in the multimodal embeddings processing pipeline. When PyTorch sparse tensors are processed, PyTorch disables invariant checks by default for performance. vLLM fails to validate that tensor indices are non-negative and within bounds, allowing malformed tensors with negative or out-of-bounds indices to be processed. An attacker with low privileges can submit crafted embedding requests when the prompt-embeds feature is enabled to trigger out-of-bounds memory writes (CWE-787), causing denial of service via crashes or resource exhaustion, with potential for arbitrary code execution. The fix requires adding explicit sparse tensor validation to check index validity. Versions 0.10.2 through 0.13.0 are affected; version 0.13.0 and later include the root-cause fix.

Affected products

  • vLLM vLLM >=0.10.2, <0.13.0

Timeline

  • 2026-06-20: disclosed: Advisory GHSA-78fp-cf4h-g36p published (later withdrawn as duplicate)
  • 2026-01-08: disclosed: Primary advisory GHSA-mcmc-2m55-j8jj published
  • 2026-01-08: patched: Fix available in vLLM 0.13.0
  • 2026-09-11: other: GHSA-78fp-cf4h-g36p withdrawn as duplicate of GHSA-mcmc-2m55-j8jj

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.