PatchTheCEVCVE-2026-56340: vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing
43
This month
HIGH 8.8UPGRADE
CVE-2026-56340 is a high-severity flaw (CVSS 8.8) affecting vllm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory
Why this priority
- High severity
A fixed release or distro patch exists.
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
vllm vllm UPGRADE
Affected: >= 0.10.2 and < 0.13.0
Fixed in: 0.13.0
Safe to downgrade to: a release before 0.10.2
1. Check installed version
apt-cache policy vllm || rpm -q vllm || vllm --version
2. UPGRADE to 0.13.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade vllm
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade vllm
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.10.2 (Debian / Ubuntu)
apt-cache madison vllm
sudo apt install vllm=<VERSION_BEFORE_0.10.2>
sudo apt-mark hold vllm
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list vllm
sudo dnf downgrade vllm-<VERSION_BEFORE_0.10.2>
sudo dnf versionlock add vllm
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-73560 MEDIUM 6.5 UPGRADE vLLM is an inference and serving engine for large language models
- CVE-2026-71486 MEDIUM 4.3 UPGRADE vLLM is an inference and serving engine for large language models