CVE-2026-56340

Katalog CVE

CVSS 7.5 · High EPSS 0,64%

Kerentanan Improper Input Validation pada vllm. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.

Rincian

Terbit di NVD

20 Juni 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-mcmc-2m55-j8jj advisory vendor
• https://www.vulncheck.com/advisories/vllm-denial-of-service-via-unvalidated-multimodal-embeddings advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2026-56340
• https://bugzilla.redhat.com/show_bug.cgi?id=2491060
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56340.json