CVE-2026-73558 vllm-project CVE debrief

Who should care

Defenders responsible for deploying and managing vLLM instances, especially those processing batched user requests, should assess their exposure to this vulnerability and prioritize verification and potential upgrades.

Why it matters

CVE-2026-73558 is a medium-severity vulnerability in the vLLM inference engine that can lead to potential exposure of user inference results. Defenders should prioritize verifying exposure in vLLM deployments, especially those processing batched user requests, and assess the need for an upgrade to version 0.27.0. The vulnerability's impact on confidentiality and the need for verification and potential upgrades make it a priority for defenders responsible for vLLM deployments.

• Potential exposure of user inference results in batched requests
• Need for verification of vLLM version and deployment configuration
• Possible impact on confidentiality of user data
• Priority for upgrading to version 0.27.0 or later

Technical summary

The vLLM inference and serving engine for large language models is vulnerable to an integer overflow in the act_and_mul_kernel function. This can cause the kernel to consume input from another batched user, potentially allowing a request in the same inference batch to receive part or all of another user's inference result. The issue is addressed in version 0.27.0. Defenders should prioritize verifying exposure in vLLM deployments, especially those processing batched user requests, and assess the need for an upgrade to version 0.27.0.

Defensive priority

Defenders should prioritize verifying exposure in vLLM deployments, especially those processing batched user requests, and assess the need for an upgrade to version 0.27.0.

Recommended defensive actions

• Verify vLLM version and assess exposure in deployments processing batched user requests
• Consider upgrading to version 0.27.0 or later
• Monitor for any indicators of compromise or anomalous inference results
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 0.27.0. However, additional information on affected deployments, exploitation, or specific attack scenarios is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.