PyPI/vllm CVE-2026-56340: high 7.5, EPSS 0.64%
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submi
Action: Upgrade vllm to 0.13.0 or later.
pip install vllm==0.13.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.10.2 | 0.13.0 | - |
Fixed versions
| 0.13.0 |
Sources
- osv: PYSEC-2026-250
- https://github.com/vllm-project/vllm/security/advisories/GHSA-mcmc-2m55-j8jj
- https://www.vulncheck.com/advisories/vllm-denial-of-service-via-unvalidated-multimodal-embeddings
CVE-2026-56340 · published · modified · JSON