CVE-2026-56340
2 advisories.
PyPI/vllm CVE-2026-56340: high 8.8
vLLM introduced enhanced protection for CVE-2025-62164
Action: Upgrade vllm to 0.13.0 or later.
pip install vllm==0.13.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.10.2 | 0.13.0 | - |
Fixed versions
| 0.13.0 |
Sources
- osv: GHSA-mcmc-2m55-j8jj
- https://github.com/vllm-project/vllm/security/advisories/GHSA-mcmc-2m55-j8jj
- https://github.com/vllm-project/vllm/pull/30649
- https://access.redhat.com/security/cve/CVE-2026-56340
- https://bugzilla.redhat.com/show_bug.cgi?id=2491060
- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-250.yaml
- https://github.com/vllm-project/vllm
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56340.json
- https://www.vulncheck.com/advisories/vllm-denial-of-service-via-unvalidated-multimodal-embeddings
CVE-2026-56340 · published · modified · JSON
PyPI/vllm CVE-2026-56340: high 7.5
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submi
Action: Upgrade vllm to 0.13.0 or later.
pip install vllm==0.13.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.10.2 | 0.13.0 | - |
Fixed versions
| 0.13.0 |
Sources
- osv: PYSEC-2026-250
- https://github.com/vllm-project/vllm/security/advisories/GHSA-mcmc-2m55-j8jj
- https://www.vulncheck.com/advisories/vllm-denial-of-service-via-unvalidated-multimodal-embeddings
CVE-2026-56340 · published · modified · JSON