EUVD-2026-38129
GHSA-mcmc-2m55-j8jj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable inference API needing a low-privilege caller (PR:L), no user interaction; demonstrated impact is crash/DoS (A:H) with only potential, unproven memory corruption, so C and I are L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3Blast Radius
ecosystem impact- 8 pypi packages depend on vllm (8 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.10.2.
DescriptionCVE.org
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.
AnalysisAI
Denial of service and potential memory corruption in vLLM versions 0.10.2 through 0.12.x stems from missing sparse tensor validation in multimodal embeddings processing, allowing authenticated remote users to submit crafted prompt-embedding requests with malformed tensor indices. Because PyTorch disables sparse tensor invariant checks by default, attackers can crash the inference server or exhaust resources, with potential out-of-bounds or write-what-where memory corruption. No public exploit identified at time of analysis; this continuation of CVE-2025-62164 addresses the root cause that the prior fix only masked by disabling the feature by default.
Technical ContextAI
vLLM is a high-throughput inference and serving engine for large language models, widely deployed for production LLM endpoints. The flaw sits in the multimodal embeddings ingestion path (the prompt-embeds feature), which accepts caller-supplied tensors and passes them to PyTorch sparse tensor APIs. PyTorch (~v2.0+) disables sparse tensor invariant checks by default for performance, so negative or out-of-bounds index values in COO/CSR-style sparse tensors are not rejected before downstream kernels dereference them. This maps to CWE-20 (Improper Input Validation): vLLM never validated that supplied indices were non-negative and within tensor dimension bounds before use. The fix in PR #30649 explicitly enables sparse-tensor invariant validation rather than relying on PyTorch defaults; affected component is the Python package pip/vllm per CPE cpe:2.3:a:vllm:vllm:*.
RemediationAI
Vendor-released patch: upgrade vLLM to 0.13.0 or later, which adds explicit sparse tensor invariant validation per pull request https://github.com/vllm-project/vllm/pull/30649 and the advisory at https://github.com/vllm-project/vllm/security/advisories/GHSA-mcmc-2m55-j8jj. If immediate upgrade is not feasible, leave the prompt-embeds feature disabled (the default since the CVE-2025-62164 fix) - concretely, do not pass the flag that re-enables prompt embeddings on the vLLM server; the trade-off is loss of multimodal embedding ingestion for any downstream applications that depend on it. As additional compensating controls, restrict the vLLM inference endpoint behind authenticated network ACLs so only trusted callers can issue requests (reduces who can deliver the crafted payload but does not eliminate insider risk), and monitor the serving process for repeated crashes or sudden RSS growth that could indicate exploitation attempts. See also the VulnCheck advisory: https://www.vulncheck.com/advisories/vllm-denial-of-service-via-unvalidated-multimodal-embeddings.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Denial of service in vllm 0.19.0's OpenAI-compatible serving path allows remote unauthenticated attackers to exhaust sch
Same weakness CWE-20 – Improper Input Validation
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today