The vulnerability (CVE-2026-56340) in vLLM arises from missing validation of sparse tensor indices in the prompt-embeds feature. PyTorch disables sparse tensor invariant checks by default for performance, and vLLM initially only disabled prompt-embeds by default rather than fixing the root cause. This allows attackers to submit malformed embedding requests that cause denial of service via crashes or resource exhaustion. Additionally, out-of-bounds memory corruption could enable arbitrary code execution. The vendor has introduced a fix that adds sparse tensor validation to ensure indices are valid, non-negative, and within bounds, mitigating the vulnerability. The affected versions are vLLM >=0.10.2 and <0.13.0. Red Hat advisory confirms the vulnerability and recommends disabling prompt-embeds and restricting access until the fixed build is applied.

An attacker can remotely cause denial of service by triggering crashes or resource exhaustion through specially crafted embedding requests when prompt-embeds is enabled. There is also potential for out-of-bounds memory corruption, which may lead to arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability of the affected system. Red Hat rates the impact as important for affected versions with prompt-embeds enabled.

Disable the prompt-embeds feature if it is not required. Restrict which users can submit multimodal embedding requests by applying authentication and rate limiting on inference APIs. Upgrade to a fixed vLLM build when it becomes available from Red Hat. The current default disables prompt-embeds, which mitigates the issue, but enabling it without the patch leaves the system vulnerable.