id: PYSEC-2026-250
published: "2026-06-20T19:16:23.567Z"
modified: "2026-06-27T10:30:03.615372Z"
aliases:
- CVE-2026-56340
- GHSA-mcmc-2m55-j8jj
details: vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.
affected:
- package:
    name: vllm
    ecosystem: PyPI
    purl: pkg:pypi/vllm
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.10.2
    - fixed: 0.13.0
  versions:
  - 0.10.2
  - 0.11.0
  - 0.11.1
  - 0.11.2
  - 0.12.0
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/vllm-project/vllm/security/advisories/GHSA-mcmc-2m55-j8jj
- type: ADVISORY
  url: https://www.vulncheck.com/advisories/vllm-denial-of-service-via-unvalidated-multimodal-embeddings
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H