CVE-2026-56340: vLLM Sparse Tensor Validation Bypass (CVSS 8.8)

Technical summary

The vulnerability stems from missing input validation of sparse tensor indices in vLLM's multimodal embeddings processing pipeline. PyTorch, the underlying framework, disables sparse tensor invariant checks by default for performance reasons. When a vLLM instance has the prompt-embeds feature enabled, an attacker with authentication credentials can craft HTTP/API requests containing embedding tensors with malformed index arrays—containing negative values, out-of-bounds offsets, or structurally invalid sparse tensor metadata. PyTorch will not catch these violations, allowing the malformed tensors to be processed. This can trigger unhandled exceptions (DoS), uncontrolled memory allocation patterns (resource exhaustion), or in worst-case scenarios, out-of-bounds memory access or write operations that corrupt the heap or other memory regions. The root cause is the absence of explicit schema validation before tensors enter the PyTorch processing path.

Business impact

Organizations running vLLM in production environments exposed to authenticated users (employees, contractors, API consumers) face service availability risk. An attacker with valid API credentials can trigger immediate crashes or gradual resource depletion, disrupting inference workloads and downstream applications that depend on the LLM service. If memory corruption occurs, an attacker could theoretically escalate to code execution, though that path requires additional preconditions. For providers offering vLLM-backed services, this creates both availability and potential data-at-rest confidentiality concerns if memory is not properly isolated.

Affected systems

vLLM versions 0.10.2, 0.10.3, 0.11.x, and 0.12.x are vulnerable when the prompt-embeds feature is enabled. Versions prior to 0.10.2 and 0.13.0 and later are not affected. Patches should be applied to all production and staging deployments running within the vulnerable range. Users of vLLM running models on CPU or GPU infrastructure, whether on-premises or cloud-hosted, should audit their installations immediately.

Exploitability

The vulnerability requires valid authentication (PR:L in CVSS terms), meaning an attacker must have legitimate API access to the vLLM deployment. The attack is network-accessible (AV:N) and carries no additional complexity (AC:L). Crafting malicious tensor payloads is straightforward—no special reverse-engineering or race conditions required. However, the feature must be explicitly enabled; if administrators disabled prompt-embeds after CVE-2025-62164, this risk is already mitigated. Exploitation does not require user interaction (UI:N). The CVSS 3.1 score of 8.8 reflects the high impact across confidentiality, integrity, and availability.

Remediation

Upgrade vLLM to version 0.13.0 or later, which includes proper input validation for sparse tensor indices in the embeddings processing code. Verify the fix addresses CWE-20 (improper input validation) and CWE-787 (out-of-bounds write) by reviewing the patch notes or commit logs. As an interim mitigation, disable the prompt-embeds feature if it is not essential to your workload. Restrict API access to trusted internal users only, reducing the authenticated attacker surface.

Patch guidance

Patch vLLM to version 0.13.0 or later. Check your current version with: `pip show vllm` or by querying the API if a version endpoint is exposed. Test the upgrade in a staging environment before deploying to production, particularly if you have custom multimodal models or tensor pipelines. Review the vLLM release notes and security advisories on GitHub to confirm that the specific validation fix for sparse tensor indices is included in your target version. If you maintain a private fork, ensure your merge includes the upstream fix commit.

Detection guidance

Monitor vLLM application logs for exceptions related to sparse tensor operations, index out-of-bounds errors, or segmentation faults in the embeddings module. Check for HTTP requests to embedding endpoints that include unusually large tensor payloads or metadata with negative indices. If you have access to vLLM's internal metrics, track memory allocation spikes or unexpected process restarts. Consider enabling PyTorch debug mode in staging to catch tensor invariant violations early. Review API access logs for authenticated users issuing repeated requests to embedding endpoints, which may indicate probing.

Why prioritize this

This vulnerability scores 8.8 (HIGH) with broad impact on confidentiality, integrity, and availability. It is a regression of a prior CVE, indicating the vendor initially underestimated the root cause, raising concerns about deployment robustness. While it requires authentication, the barrier is low in multi-tenant or SaaS environments. vLLM is increasingly critical in enterprise AI pipelines; compromising inference service availability or enabling memory corruption has direct business consequences. Patch immediately for production deployments.

Risk score, explained

CVSS 3.1 score of 8.8 reflects: Network accessibility (AV:N) lowers the barrier to exploitation; low authentication requirement (PR:L) is typical for API-based services; low attack complexity (AC:L) because crafting malformed tensors requires only basic API knowledge; and high impact across all three security dimensions (C:H, I:H, A:H). The high integrity score reflects potential memory corruption or out-of-bounds writes, while high availability reflects DoS risk. The score does not assume the feature is enabled, so defenders who disabled it post-CVE-2025-62164 face lower actual risk.

Frequently asked questions