CVE-2026-73557Disclosure

LOWCVSS 6.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-362

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-08-13); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-13	2	Disclosure1General1
2026-09-06	1	Disclosure1

Full discourse3 posts

عيسى الصفحي@eissasafhi140822d
Disclosure
ثغرة ⚠️ SECURITY ALERT ──────────────────── 🚨 CVE-2026-73557 🔴 الخطورة متوسطة MEDIUM | 5.5/10 🟨🟨🟨 ✅ حالة الاستغلال غير مستغلة - CISA 📈 احتمالية الاستغلال 0.3% - EPSS 📦 المنتج vllm 📄 التحليل ❝ vLLM: يمكن تجاوز المعالجة غير المكتملة CVE-2025-62164
Post summary
A short security alert announcing CVE-2026-73557 for the vllm product, indicating medium severity, no current exploitation, and providing no PoC, exploit, or patch details.
10000110
232 followersView on X
Infoflowcloud@infoflowcloud46d
General
🚨*CVE* CVE-2026-73557 vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sp… https://www.cve.org/CVERecord?id=CVE-2026-73557 ----- Traducción: CVE-2026-73557 vLL… https://infoflow.cloud`
Post summary
The tweet simply references a CVE record and a brief code location, with no evidence of PoC, exploit, active attacks, patch, or technical details.
0000024
97 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-73557 vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sp… https://www.cve.org/CVERecord?id=CVE-2026-73557
Post summary
The post references CVE-2026-73557, indicating that vLLM versions 0.20.2rc0 to 0.26.0 contain a vulnerable safe_load_prompt_embeds function that uses torch.sp. No exploitation code, patch, or active attack claims are provided.
00000792
57.9K followersView on X

Explore more

Back to dashboard