CVE-2026-73557

CVE-2026-73557 affects vLLM between 0.20.2rc0 and 0.26.0. The flaw arises in safe_load_prompt_embeds in vllm/renderers/embed_utils.py, where using torch.sparse.check_sparse_tensor_invariants with a process-global save/enable/restore state can be raced via concurrent prompt_embeds (POST /v1/chat/c...

CVE-2026-73557

vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safeloadpromptembeds in vllm/renderers/embedutils.py uses torch.sparse.checksparsetensorinvariants, whose process-global save, enable, and restore state can be raced by concurrent promptembeds parts...

CVE-2026-73557 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safeloadpromptembeds in vllm/renderers/embedutils.py uses torch.sparse.checksparsetensorinvariants, whose process-global save, enable, and restore state can be raced by concurrent promptembeds parts...