DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-73557: CVE-2026-73557: Race Condition in PyTorch Tensor Invariant Checks within vLLM Engine

#security #cve #cybersecurity

CVE-2026-73557: Race Condition in PyTorch Tensor Invariant Checks within vLLM Engine

Vulnerability ID: CVE-2026-73557
CVSS Score: 6.3
Published: 2026-09-04

CVE-2026-73557 details a race condition vulnerability in the vLLM serving framework, arising from the thread-unsafe usage of PyTorch's process-global sparse tensor invariant check manager. When processing concurrent requests with custom prompt or multimodal embeddings, concurrent thread execution can disable global tensor integrity checks. An unauthenticated attacker can leverage this timing window to submit malformed sparse coordinate (COO) tensors containing out-of-bounds indices, causing memory corruption and process crashes (Denial of Service).

TL;DR

A race condition in vLLM's custom embedding loaders allows unauthenticated attackers to bypass PyTorch sparse tensor validation, causing out-of-bounds writes and server crashes via crafted requests.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-362
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.3 (Medium)
  • EPSS Score: 0.00251
  • Impact: Denial of Service (Process Crash)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • vLLM server environments utilizing prompt embeddings
  • vLLM server environments utilizing multimodal media loaders (audio, image)
  • vLLM: >= 0.20.2rc0, < 0.26.0 (Fixed in: 0.26.0)

Code Analysis

Commit: 793cf79

Add thread-safe wrapper for sparse tensor invariant validation

@@ -23,9 +24,7 @@ def safe_load_prompt_embeds(\n-    with torch.sparse.check_sparse_tensor_invariants():\n+    with check_sparse_tensor_invariants_threadsafe():
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade vLLM to version 0.26.0 or higher
  • Disable prompt embeddings if they are not strictly required
  • Disable multimodal embeddings to reduce the API attack surface
  • Deploy WAF rules to block or inspect requests containing custom serialized tensors

Remediation Steps:

  1. Identify running instances of vLLM and check their active command-line flags.
  2. Remove '--enable-prompt-embeds' and '--enable-mm-embeds' from the daemon arguments if untrusted API consumers have access.
  3. Update the vLLM package via pip or build a new container using vLLM >= 0.26.0.
  4. Restart the service and verify that concurrent embedding processing operates normally and rejects invalid tensor structures.

References

Read the full report for CVE-2026-73557 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)