CVE-2026-73557

[CVE catalog]

Severity

Medium · CVSS 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Aug 13, 2026, 3:00:15 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.25% · Oct 25, 2026

A flaw was found in vLLM, an inference and serving engine for large language models. An incomplete remediation for a previous vulnerability (CVE-2025-62164) can be bypassed. This occurs when concurrent prompt parts are processed, leading to a race condition in the handling of sparse tensors. This vulnerability could allow an attacker to cause a denial of service. vllm: vLLM: Incomplete remediation allows bypass via concurrent prompt processing This Moderate impact flaw in vLLM, an inference and serving engine for large language models, arises from an incomplete remediation for a race condition. When `enable_prompt_embeds` is active, concurrent prompt processing can lead to an invalid sparse tensor being processed, potentially causing a denial of service. This issue primarily affects deployments utilizing vLLM with multimodal features enabled. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.