CVE-2026-73557: vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safeloadpromptembeds in vllm/renderers/embedutils.py uses torch.sparse.checksparsetensorinvariants, whose process-global save, enable, and restore state can be raced by concurrent promptembeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolveitems, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.todense despite the CVE-2025-62164 guard when enablepromptembeds is enabled. This issue is fixed in version 0.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73557?
The severity of CVE-2026-73557 is rated at 65.
How do I fix CVE-2026-73557?
To fix CVE-2026-73557, update vLLM to version 0.26.0 or later.
What type of vulnerability is CVE-2026-73557?
CVE-2026-73557 is classified as a Race Condition vulnerability.
What versions of vLLM are affected by CVE-2026-73557?
CVE-2026-73557 affects vLLM versions from 0.20.2rc0 until 0.26.0.
What components are involved in CVE-2026-73557?
CVE-2026-73557 specifically involves the safe_load_prompt_embeds function in vllm/renderers/embed_utils.py.