CVE-2026-73558: vLLM: Cross-User Data Leak Vulnerability
An integer overflow in the act_and_mul_kernel kernel can cause the output of one user request to be incorporated into the response of another request within the same inference batch. Under certain conditions, the last request in a batch can receive a partial or complete copy of the first user’s inference result, resulting in cross-user data leakage.
References
- github.com/advisories/GHSA-7m6h-x95x-82q5
- github.com/vllm-project/vllm/commit/451227cb3ff07989698fed982c2d3e4300257924
- github.com/vllm-project/vllm/issues/42860
- github.com/vllm-project/vllm/pull/49660
- github.com/vllm-project/vllm/releases/tag/v0.27.0
- github.com/vllm-project/vllm/security/advisories/GHSA-7m6h-x95x-82q5
- nvd.nist.gov/vuln/detail/CVE-2026-73558
Code Behaviors & Features
Detect and mitigate CVE-2026-73558 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →