CVE-2026-73557

vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safeloadpromptembeds in vllm/renderers/embedutils.py uses torch.sparse.checksparsetensorinvariants, whose process-global save, enable, and restore state can be raced by concurrent promptembeds parts...

PT-2026-71675

Name of the Vulnerable Software and Affected Versions vLLM versions 0.19.0 through 0.25.0 Description The /v1/completions endpoint accepts an unbounded prompt field within the CompletionRequest. The prompt to seq and OnlineRenderer.preprocess completion functions expand every element of the input...