CVE-2026-73557 in vLLM
Summary
by MITRE • 08/13/2026
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability exists within vllm's prompt embedding processing mechanism where the safe_load_prompt_embeds function in vllm/renderers/embed_utils.py fails to properly handle concurrent access to sparse tensor state management. This flaw occurs when multiple concurrent requests are processed through the POST /v1/chat/completions endpoint, specifically when enable_prompt_embeds is activated. The root cause stems from the use of torch.sparse.check_sparse_tensor_invariants which maintains process-global state variables for save, enable, and restore operations. When multiple asynchronous prompt embedding tasks are executed concurrently via AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, these global state variables become subject to race conditions that can corrupt the sparse tensor representation.
The technical execution of this vulnerability leverages the concurrent nature of the async processing pipeline where multiple threads or processes attempt to modify the same global sparse tensor state simultaneously. The race condition manifests when one thread saves the current state while another attempts to enable or restore the state, leading to inconsistent internal representations that bypass the CVE-2025-62164 protection mechanism. Even though the system has safeguards in place to prevent invalid sparse tensors from reaching tensor.to_dense conversion, the concurrent access pattern allows corrupted states to slip through these protections due to the lack of proper synchronization around the global state management functions.
This vulnerability presents significant operational impact as it could allow malicious actors to potentially inject malformed sparse tensor data into the inference pipeline, which might result in incorrect model outputs or, in more severe scenarios, could be exploited to influence model behavior through crafted prompt embeddings. The issue affects systems that rely on vllm's multimodal capabilities and prompt embedding features, particularly those handling high-concurrency workloads where multiple users submit requests simultaneously. The vulnerability is classified under CWE-362 as a race condition in resource management, and aligns with ATT&CK technique T1059.001 for command and script injection through malformed data processing.
The fix implemented in version 0.26.0 addresses this issue by introducing proper synchronization mechanisms around the global sparse tensor state operations, ensuring that concurrent access to save, enable, and restore functions is properly serialized. This update resolves the race condition by either implementing mutex locks or similar synchronization primitives around the affected functions, preventing multiple concurrent threads from corrupting the shared state. Additionally, the fix likely includes enhanced validation checks that occur before any sparse tensor conversion to dense format, ensuring that corrupted states cannot bypass the security protections even if they manage to enter the processing pipeline through race conditions. The mitigation strategy reinforces proper resource management practices and aligns with industry standards for concurrent programming in machine learning inference systems where shared state must be carefully controlled to prevent data corruption and security vulnerabilities.