CVE-2026-73558: vLLM: Cross-User Data Leak Vulnerability
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.27.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73558?
CVE-2026-73558 has a medium severity score of 5.3.
What does CVE-2026-73558 entail?
CVE-2026-73558 describes a cross-user data leak vulnerability in vLLM due to an integer overflow issue.
How do I fix CVE-2026-73558?
To fix CVE-2026-73558, upgrade your vLLM software to version 0.27.0 or later.
What impact does CVE-2026-73558 have on data security?
CVE-2026-73558 can lead to unintended exposure of another user's data during the inference process.
Is CVE-2026-73558 related to specific software?
Yes, CVE-2026-73558 specifically affects the vLLM inference and serving engine for large language models.