{"data":{"id":"6fa7a9d2-9ac5-471b-8e3e-ab7d191bc9bb","title":"CVE-2026-56340: vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because…","summary":"vLLM versions 0.10.2 up to but not including 0.13.0 lack sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, crafted embedding requests with malformed (negative or out-of-bounds) tensor indices can crash the server or exhaust resources when the prompt-embeds feature is enabled. The source also notes potential out-of-bounds write (write-what-where) memory corruption. This continues CVE-2025-62164, whose earlier fix only disabled the feature by default.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56340","publishedAt":"2026-06-20T19:16:23.567Z","cveId":"CVE-2026-56340","cweIds":["CWE-20"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["denial_of_service","other"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.10.2, < 0.13.0 (fixed: 0.13.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM multimodal embeddings processing missing sparse tensor validation","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00644,"epssCheckedAt":"2026-11-04T06:10:15.975Z","kevDateAdded":null,"advisoryAliases":["GHSA-mcmc-2m55-j8jj"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:47:35.584Z","patchAvailable":true,"disclosureDate":"2026-06-20T19:16:23.567Z","fixReleasedAt":"2025-12-19T03:30:32.741Z","daysToFix":-183,"fixCheckedAt":"2026-10-29T21:34:00.022Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability","integrity"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.13.0","matchedVersion":"0.13.0","fixReleasedAt":"2025-12-19T03:30:32.741Z","daysToFix":-183,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:33:59.877Z"}]}}