CVE-2026-73557: vLLM: race condition bypasses prompt-embeds tensor guard

vLLM's prompt-embeds ingestion path is vulnerable to a race condition: when multiple prompt_embeds parts are submitted concurrently to POST /v1/chat/completions, the process-global state used by torch.sparse.check_sparse_tensor_invariants can be manipulated by one request while another is validated, letting a malformed sparse tensor slip past the safety check added for CVE-2025-62164 and reach tensor.to_dense unchecked. For CISOs, the practical concern today is availability rather than remote code execution — an attacker who can send concurrent requests to a vLLM endpoint with enable_prompt_embeds turned on could trigger crashes or undefined behavior in the inference worker, and the flaw only affects deployments that explicitly expose prompt-embeddings ingestion, which narrows but does not eliminate exposure. EPSS sits at a low 0.0025 with no CISA KEV listing, no public PoC, and no Nuclei template, and CISA's own SSVC decision is TRACK — this is not an urgent, actively-exploited bug, but it does bypass a previously shipped security control, which is the kind of regression worth closing quickly. Patch to vLLM 0.26.0, and until upgraded, disable enable_prompt_embeds or restrict access to trusted callers only, since that flag is the sole precondition for exploitation. Monitor inference worker crash/restart logs for anomalies correlated with bursts of concurrent chat-completions requests carrying prompt_embeds payloads.

No confirmed active exploitation of CVE-2026-73557 has been reported, but organizations should still patch proactively.

Upgrade to vLLM 0.26.0 or later, which fixes the race. If immediate upgrade isn't possible, disable enable_prompt_embeds unless prompt-embeds ingestion is a hard product requirement — this closes the only entry point for the bug. Where prompt_embeds must stay enabled, consider rate-limiting or serializing concurrent requests to a given worker, or isolating prompt_embeds-handling workers from general inference traffic to reduce the chance of a successful race. For detection, monitor vLLM worker process restarts/crashes and correlate with concurrent chat-completions traffic carrying multimodal prompt_embeds parts; review the fix commit (793cf79) and GHSA-pr7f-p5mw-fc87 for technical detail before deciding on interim mitigations.

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference APIs, multimodal inference pipelines.

No CVSS score has been assigned yet.