vLLM: race in the prompt_embeds sparse-tensor guard reopens the CVE-2025-62164 crash path

CVSS 6.3CVE-2026-73557AI/ML frameworks & servingcurated

Impact

safe_load_prompt_embeds relies on torch.sparse.check_sparse_tensor_invariants, whose enable/restore state is process-global. Concurrent prompt_embeds parts in one /v1/chat/completions request are resolved in parallel, so one coroutine can turn the check off while another is validating, letting a malformed sparse tensor reach tensor.to_dense and defeat the fix made for CVE-2025-62164. The result is a crash of the serving process: every in-flight request on that GPU is lost and the node is unavailable for the minutes it takes to reload weights. Only deployments that set enable_prompt_embeds are affected, which is a minority of serving configurations.

Who can reach it

A client able to POST to /v1/chat/completions on a vLLM instance running with enable_prompt_embeds. The advisory record scores it as requiring no privileges, so an endpoint exposed without authentication is reachable by anyone who can route to it.

What to do

Upgrade to vLLM 0.26.0 and restart the serving processes. If you cannot upgrade now, unset enable_prompt_embeds - the vulnerable path is not reachable without it - which also requires restarting the server. Affected from 0.20.2rc0 up to 0.26.0.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73557 https://github.com/vllm-project/vllm/security/advisories/GHSA-pr7f-p5mw-fc87 https://github.com/vllm-project/vllm/commit/793cf79c89d4049124e756915468ac30318f2e50 https://github.com/vllm-project/vllm/releases/tag/v0.26.0

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.