CVE-2026-56340: vLLM Sparse Tensor DoS Vulnerability

CVE-2026-56340 Overview

CVE-2026-56340 affects vLLM versions >= 0.10.2 and < 0.13.0. The vulnerability stems from missing sparse tensor validation in multimodal embeddings processing. PyTorch disables sparse tensor invariant checks by default, so vLLM accepts crafted embedding requests without verifying tensor indices. Attackers can submit malformed tensors with negative or out-of-bounds indices when the prompt-embeds feature is enabled. The result ranges from process crashes and resource exhaustion to potential out-of-bounds memory writes. This issue continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause [CWE-20].

Critical Impact
Authenticated network attackers can trigger denial of service and potential write-what-where memory corruption against vLLM inference servers with prompt-embeds enabled.

Affected Products

vLLM >= 0.10.2
vLLM < 0.13.0
Deployments with the prompt-embeds feature enabled

Discovery Timeline

2026-06-20 - CVE-2026-56340 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56340

Vulnerability Analysis

The flaw resides in vLLM's multimodal embeddings processing path. When the prompt-embeds feature is enabled, the server accepts client-supplied tensor payloads representing embedding inputs. vLLM passes these tensors into PyTorch operations without validating sparse tensor invariants. PyTorch skips invariant checks for sparse tensors by default to preserve performance. An attacker who can submit inference requests can therefore craft sparse tensors with indices that violate shape constraints. Operations on these tensors dereference memory outside the intended allocation, producing crashes, resource exhaustion, or memory corruption.

Root Cause

The root cause is improper input validation [CWE-20] on tensor structures received over the API. vLLM trusts caller-provided index arrays in sparse tensors and never rejects negative indices or indices that exceed declared dimensions. The earlier fix for CVE-2025-62164 disabled prompt-embeds by default but left the underlying validation gap intact. Operators who re-enable the feature inherit the same exposure.

Attack Vector

The attack vector is network-based and requires only low privileges, typically a valid API token for the inference endpoint. The attacker constructs an HTTP request to the embeddings or completions endpoint containing a sparse tensor whose indices tensor includes negative values or values outside the declared size. When vLLM forwards the tensor to PyTorch kernels, the unchecked indices reference arbitrary memory offsets. This produces immediate denial of service and, in some kernels, enables write-what-where corruption of the worker process. No user interaction is required. See the GitHub Security Advisory and the VulnCheck Denial of Service Advisory for technical details.

Detection Methods for CVE-2026-56340

Indicators of Compromise

Repeated worker process crashes or restarts in vLLM logs correlated with prompt_embeds requests.
API requests containing sparse tensor payloads with unusually large indices arrays or negative integer values.
Sudden spikes in GPU memory allocation or out-of-memory errors during embedding processing.

Detection Strategies

Inspect API request payloads for sparse tensor structures and validate that indices fall within declared tensor dimensions before forwarding.
Alert on vllm worker exit codes, segmentation faults, and CUDA assertion failures recorded in container or systemd logs.
Correlate authentication identity with crash events to surface accounts probing the prompt-embeds endpoint.

Monitoring Recommendations

Forward vLLM application logs and container runtime events to a centralized logging pipeline for query and retention.
Track per-token request volume against the embeddings endpoint and flag anomalous payload sizes.
Monitor GPU process lifecycle metrics via nvidia-smi exporters to detect repeated worker termination.

How to Mitigate CVE-2026-56340

Immediate Actions Required

Upgrade vLLM to version 0.13.0 or later, which contains the validation fix.
Disable the prompt-embeds feature on any deployment that does not require it.
Restrict access to the inference API using network controls and short-lived authentication tokens.
Audit deployment configurations to confirm prompt-embeds was not re-enabled after the CVE-2025-62164 mitigation.

Patch Information

Upgrade to vLLM 0.13.0 or later. The fix adds sparse tensor invariant validation in the multimodal embeddings path so that malformed indices are rejected before reaching PyTorch kernels. Refer to the GitHub Security Advisory GHSA-mcmc-2m55-j8jj for commit-level details.

Workarounds

Keep the prompt-embeds feature disabled, which is the default in patched releases.
Place vLLM behind an authenticating reverse proxy that rejects requests containing serialized sparse tensors.
Run vLLM workers under resource limits and automatic restart policies to contain denial-of-service impact until patching is complete.

bash

# Configuration example: upgrade vLLM and verify prompt-embeds is disabled
pip install --upgrade "vllm>=0.13.0"

# Start the server without enabling prompt-embeds
vllm serve <model> \
  --host 0.0.0.0 \
  --port 8000
# Do NOT pass --enable-prompt-embeds unless strictly required