VDB
CVE-2026-73558
CVE-2026-73558
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published August 13, 2026
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vllm-project | vllm | < 0.27.0 |
| vllm-project | vllm | 0 |
| PyPI | vllm | 0 |
| chainguard | tritonserver-backend-vllm-cuda-13.0 | 0 |
Timeline
- Aug 13, 2026 CVE Published
- Aug 13, 2026 CVE Updated
- Aug 14, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 28, 2026 EPSS Score
- Sep 5, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 10, 2026 EPSS Score
- Sep 15, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-7m6h-x95x-82q5 x_refsource_CONFIRM
- https://github.com/vllm-project/vllm/issues/42860 x_refsource_MISC
- https://github.com/vllm-project/vllm/pull/49660 x_refsource_MISC
- https://github.com/vllm-project/vllm/commit/451227cb3ff07989698fed982c2d3e4300257924 x_refsource_MISC
- https://github.com/vllm-project/vllm/releases/tag/v0.27.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-73558 advisory
- https://github.com/advisories/GHSA-7m6h-x95x-82q5 advisory