Junglewise Threat Intelligence

vLLM missing tensor validation in multimodal embeddings

Severity: high · CVSS 8.8 · Published 2026-06-20

Technologies: Vllm. Vendors: Vllm.

Executive brief

vLLM is a large language model serving framework widely used for deploying AI models. The prompt-embeds feature in vLLM versions 0.10.2 through 0.13.0 fails to properly validate tensor data submitted by users, allowing attackers to crash the service or corrupt memory with specially crafted requests. While the feature is disabled by default, organizations that enable it for multimodal embedding support face high risk of service outages or potential code execution if an attacker gains access to send embedding requests.

Technical details

The vulnerability is a missing input validation flaw (CWE-20) in the multimodal embeddings processing pipeline. When PyTorch sparse tensors are processed, PyTorch disables invariant checks by default for performance. vLLM fails to validate that tensor indices are non-negative and within bounds, allowing malformed tensors with negative or out-of-bounds indices to be processed. An attacker with low privileges can submit crafted embedding requests when the prompt-embeds feature is enabled to trigger out-of-bounds memory writes (CWE-787), causing denial of service via crashes or resource exhaustion, with potential for arbitrary code execution. The fix requires adding explicit sparse tensor validation to check index validity. Versions 0.10.2 through 0.13.0 are affected; version 0.13.0 and later include the root-cause fix.

Affected products

  • vLLM vLLM >=0.10.2, <0.13.0

Timeline

  • 2026-06-20: disclosed: Advisory GHSA-78fp-cf4h-g36p published (later withdrawn as duplicate)
  • 2026-01-08: disclosed: Primary advisory GHSA-mcmc-2m55-j8jj published
  • 2026-01-08: patched: Fix available in vLLM 0.13.0
  • 2026-09-11: other: GHSA-78fp-cf4h-g36p withdrawn as duplicate of GHSA-mcmc-2m55-j8jj

References

Related threats