vLLM (sparse tensor validation): Missing sparse-tensor invariant checks in multimodal embeddings

Impact

Missing sparse-tensor invariant checks in multimodal embeddings → memory corruption

Who can reach it

Unauthenticated request to the serving port

What to do

Upgrade past 0.13.0; PyTorch disables sparse invariant checks by default, so the fix must be in vLLM

References

Related entries

• Ray (WebDataset reader): Unsafe deserializationCVE-2026-57516 · Ray (WebDataset reader)High
• Weaviate: RBAC role assignment does not verify the assigner holds the granted permissionsCVE-2026-59093 · WeaviateHigh
• LiteLLM Proxy: forged Authorization header reaches MCP tooling without a valid API keyCVE-2026-59822 · LiteLLM Proxy (MCP Streamable HTTP endpoint authentication)High
• NVIDIA OpenShell: a malicious gateway can inject OS commands into the connecting clientCVE-2026-65091 · NVIDIA OpenShell (gateway response handling)High
• NVIDIA NeMo: TabularTokenizer unpickles an attacker-supplied .pkl file, giving code executionCVE-2026-65179 · NVIDIA NeMo (TabularTokenizer pickle.load of an untrusted .pkl)High
• Hugging Face peft: CorDA and LoRA-GA load cache files with unsafe torch.load, giving code executionCVE-2026-71281 · Hugging Face peft - LoRA-GA and CorDA initialization (torch.load without weights_only)High