EUVD-2026-58064Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Race condition requires precise thread interleaving timing (AC:H); no authentication needed for API access (PR:N); impact is availability-only at Low severity with unchanged scope.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.
AnalysisAI
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant guard introduced for CVE-2025-62164, permitting an invalid sparse tensor to reach tensor.to_dense() and cause availability disruption. Affected deployments span versions 0.20.2rc0 through 0.25.x and are limited to instances with enable_prompt_embeds explicitly enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires `enable_prompt_embeds` to be explicitly set in the vLLM server configuration - this is a non-default setting that must be deliberately enabled by operators to support multimodal prompt embedding workflows. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.3) characterizes this as a network-reachable, low-complexity, unauthenticated attack with an attack requirement (AT:P) reflecting the non-default `enable_prompt_embeds` configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to a vLLM API endpoint (with `enable_prompt_embeds` enabled) sends two near-simultaneous POST /v1/chat/completions requests: one containing a legitimate prompt embedding and one containing a crafted malicious sparse tensor with out-of-bounds indices constructed with `check_invariants=False`. The asyncio.gather-dispatched thread pool creates the race window where Thread A enables the invariant check, Thread B's malicious tensor is deserialized during that window, Thread A completes and restores the disabled state, and Thread B's tensor then reaches `to_dense()` without the guard active - causing a runtime error or availability disruption. … |
| Remediation | Upgrade vLLM to version 0.26.0 or later, which replaces the non-thread-safe `torch.sparse.check_sparse_tensor_invariants` context manager with the thread-safe `check_sparse_tensor_invariants_threadsafe` locking wrapper, as implemented in commit 793cf79c89d4049124e756915468ac30318f2e50 (https://github.com/vllm-project/vllm/commit/793cf79c89d4049124e756915468ac30318f2e50) and released at https://github.com/vllm-project/vllm/releases/tag/v0.26.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Denial of service in vllm 0.19.0's OpenAI-compatible serving path allows remote unauthenticated attackers to exhaust sch
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 9.0)
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today