{"vulnerability": "cve-2026-7355", "sightings": [{"uuid": "2bd3534b-6f09-4f41-9d71-fa3093faa646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7355", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260429", "content": "", "creation_timestamp": "2026-04-28T20:00:00.000000Z"}, {"uuid": "6c0438f3-d55d-4242-9593-f61826da4839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7355", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mklusetkht2e", "content": "", "creation_timestamp": "2026-04-29T00:47:20.902621Z"}, {"uuid": "4ca910b7-8da4-40d1-a580-abeae3787bc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7355", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260504", "content": "", "creation_timestamp": "2026-05-03T18:00:00.000000Z"}, {"uuid": "63738287-c304-4f2c-8e77-27d4770519f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7355", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mlg3sznbz62l", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-7355 google\u306echrome\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\nGoogle Chrome 147.0.7727.138 \u3088\u308a\u524d\u306e Media \u306b\u89e3\u653e\u5f8c\u4f7f\u7528\uff08use after free\uff09\u306e\u8106\u5f31\u6027\u304c\u3042\u308a\u3001\u7d30\u5de5\u3055\u308c\u305f HTML \u30da\u30fc\u30b8\u3092\u4ecb\u3057\u3066\u3001", "creation_timestamp": "2026-05-09T11:02:13.127807Z"}, {"uuid": "07636497-4c82-47e8-a3c2-2c7353045143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73559", "type": "seen", "source": "https://gist.github.com/alon710/8cc39c03d7f0aab8c747b6a46222fd6c", "content": "# CVE-2026-73559: CVE-2026-73559: Uncontrolled Resource Consumption in vLLM API completions\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73559\n\n## Summary\nCVE-2026-73559 is an uncontrolled resource consumption vulnerability in the vLLM engine, specifically within the /v1/completions API endpoint, allowing authenticated attackers to cause application-level denial of service via unbounded prompt arrays.\n\n## TL;DR\nvLLM is vulnerable to memory and queue exhaustion via unbounded prompt arrays in the completions API, fixed in v0.26.0.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: PoC / Theoretical\n\n## Affected Systems\n\n- vLLM Engine\n- **vllm**: >= 0.19.0, < 0.26.0 (Fixed in: `0.26.0`)\n\n## Mitigation\n\n- Upgrade vLLM to version 0.26.0 or later\n- Implement request size filtering at the API Gateway level\n- Configure VLLM_MAX_COMPLETION_PROMPTS to a low threshold\n\n**Remediation Steps:**\n1. Verify current vLLM version using pip show vllm\n2. Upgrade to the patched release via pip install --upgrade vllm>=0.26.0\n3. Restart the vLLM service process to apply changes\n\n## References\n\n- [vLLM Security Advisory](https://github.com/vllm-project/vllm/security/advisories/GHSA-87x5-vmc3-756j)\n- [vLLM Pull Request #47845](https://github.com/vllm-project/vllm/pull/47845)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73559) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-13T19:32:34.136744Z"}, {"uuid": "5b219a7a-c880-4a30-a7f7-86709a67e0ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73557", "type": "seen", "source": "https://gist.github.com/alon710/a3b659a3184d1b4a8114704d88ee63de", "content": "# CVE-2026-73557: CVE-2026-73557: Race Condition in PyTorch Tensor Invariant Checks within vLLM Engine\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73557\n\n## Summary\nCVE-2026-73557 details a race condition vulnerability in the vLLM serving framework, arising from the thread-unsafe usage of PyTorch's process-global sparse tensor invariant check manager. When processing concurrent requests with custom prompt or multimodal embeddings, concurrent thread execution can disable global tensor integrity checks. An unauthenticated attacker can leverage this timing window to submit malformed sparse coordinate (COO) tensors containing out-of-bounds indices, causing memory corruption and process crashes (Denial of Service).\n\n## TL;DR\nA race condition in vLLM's custom embedding loaders allows unauthenticated attackers to bypass PyTorch sparse tensor validation, causing out-of-bounds writes and server crashes via crafted requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-362\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.3 (Medium)\n- **EPSS Score**: 0.00251\n- **Impact**: Denial of Service (Process Crash)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- vLLM server environments utilizing prompt embeddings\n- vLLM server environments utilizing multimodal media loaders (audio, image)\n- **vLLM**: >= 0.20.2rc0, < 0.26.0 (Fixed in: `0.26.0`)\n\n## Mitigation\n\n- Upgrade vLLM to version 0.26.0 or higher\n- Disable prompt embeddings if they are not strictly required\n- Disable multimodal embeddings to reduce the API attack surface\n- Deploy WAF rules to block or inspect requests containing custom serialized tensors\n\n**Remediation Steps:**\n1. Identify running instances of vLLM and check their active command-line flags.\n2. Remove '--enable-prompt-embeds' and '--enable-mm-embeds' from the daemon arguments if untrusted API consumers have access.\n3. Update the vLLM package via pip or build a new container using vLLM >= 0.26.0.\n4. Restart the service and verify that concurrent embedding processing operates normally and rejects invalid tensor structures.\n\n## References\n\n- [vLLM Fix Commit 793cf79c89d4](https://github.com/vllm-project/vllm/commit/793cf79c89d4049124e756915468ac30318f2e50)\n- [vLLM Pull Request 48583](https://github.com/vllm-project/vllm/pull/48583)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73557) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T00:32:12.626922Z"}, {"uuid": "c64847ef-69f1-4afd-9921-94477f7fbbcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73554", "type": "seen", "source": "Telegram/saF7t803_3F3Ra_Gsh2itlwbpKCr-JJsYdlNdWBMzEsIfS4", "content": "", "creation_timestamp": "2026-09-05T01:00:04.581792Z"}, {"uuid": "449c575d-13f2-4064-8761-8d76d5ebf349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73556", "type": "seen", "source": "https://gist.github.com/alon710/895e3529203111e967ac445fa47d3415", "content": "# CVE-2026-73556: CVE-2026-73556: Regular Expression Denial of Service (ReDoS) in vLLM lm-format-enforcer Backend\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73556\n\n## Summary\nCVE-2026-73556 is a Regular Expression Denial of Service (ReDoS) vulnerability in the vLLM inference engine's lm-format-enforcer structured-output backend. Prior to version 0.26.0, lack of compilation timeouts or complexity validation for user-supplied regular expressions in the structured_outputs.regex parameter allowed unauthenticated remote attackers to trigger CPU exhaustion and block the core execution loop.\n\n## TL;DR\nUnauthenticated remote attackers can cause a complete Denial of Service (DoS) in vLLM by submitting a maliciously crafted regular expression that triggers exponential backtracking in the lm-format-enforcer backend, pinning the CPU at 100%.\n\n## Technical Details\n\n- **CWE ID**: CWE-1333 / CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00315 (Percentile: 23.90%)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: No Public PoC Found\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- vLLM\n- **vllm**: < 0.26.0 (Fixed in: `0.26.0`)\n\n## Mitigation\n\n- Upgrade vLLM to version 0.26.0 or higher.\n- Restrict maximum regex pattern string lengths via external API gateway rules.\n- Implement WAF signature filtering to block nested quantifiers in JSON payloads.\n- Enforce network-level access control and authentication on vLLM endpoints.\n\n**Remediation Steps:**\n1. Identify running vLLM containers and environments.\n2. Update the dependency manifest to vLLM >= 0.26.0.\n3. Deploy the updated application to production.\n4. Verify configuration settings to ensure the correct backend timeout behaves as expected.\n\n## References\n\n- [vLLM Security Advisory (GHSA-48jh-3gj7-fg8v)](https://github.com/vllm-project/vllm/security/advisories/GHSA-48jh-3gj7-fg8v)\n- [vLLM Pull Request #47595](https://github.com/vllm-project/vllm/pull/47595)\n- [vLLM Fix Commit](https://github.com/vllm-project/vllm/commit/c9a788eedc412acceaa5112e0d44624b49841577)\n- [vLLM Release v0.26.0](https://github.com/vllm-project/vllm/releases/tag/v0.26.0)\n- [NVD CVE-2026-73556 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-73556)\n- [CVE.org Record for CVE-2026-73556](https://www.cve.org/CVERecord?id=CVE-2026-73556)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73556) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T01:31:34.952197Z"}, {"uuid": "6110df07-faf4-4c5d-8490-5e6ab4cb50be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73555", "type": "seen", "source": "https://gist.github.com/alon710/caaecd86a36ed3811c785ce5c946eae7", "content": "# CVE-2026-73555: CVE-2026-73555: Environment and Information Disclosure via Exception Handling in vLLM\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73555\n\n## Summary\nAn information disclosure vulnerability in vLLM prior to version 0.26.0 allows unauthenticated remote attackers to trigger validation errors that expose highly sensitive host machine metadata, absolute paths, environment structures, and usernames. This flaw stems from improper serialization of Pydantic exceptions and an inadequate fallback sanitization function.\n\n## TL;DR\nUnauthenticated remote attackers can query vLLM API endpoints with malformed JSON to retrieve full system paths, virtual environment directory structures, and host usernames from error tracebacks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-209\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.3 (Medium)\n- **EPSS Score**: 0.00255\n- **Impact**: Information Disclosure\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- vLLM API Server deployments running version < 0.26.0\n- **vllm**: < 0.26.0 (Fixed in: `0.26.0`)\n\n## Mitigation\n\n- Upgrade vLLM to version 0.26.0 or above to remediate path and context leak vectors.\n- Implement a reverse proxy or Web Application Firewall (WAF) to filter detailed response payloads containing tracebacks.\n- Configure container boundaries to utilize non-privileged usernames and run within virtual isolated roots like scratch directories.\n\n**Remediation Steps:**\n1. Identify all current deployments of vLLM utilizing versions prior to 0.26.0.\n2. Update requirements and pull the latest v0.26.0 container images or python packages.\n3. Verify the remediation by sending a malformed request to `/v1/chat/completions` and ensuring no absolute file paths are returned in the response payload.\n\n## References\n\n- [vLLM Github Security Advisory](https://github.com/vllm-project/vllm/security/advisories/GHSA-hwrm-c4cx-rf4j)\n- [vLLM Patch Commit](https://github.com/vllm-project/vllm/commit/e87521626febe2763f997691d1599de4175f4324)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73555) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T02:32:31.573312Z"}, {"uuid": "70360b68-0ff1-4913-9dd4-2133c2571c44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-73558", "type": "published-proof-of-concept", "source": "https://github.com/vllm-project/vllm/security/advisories/GHSA-7m6h-x95x-82q5", "content": "", "creation_timestamp": "2026-09-08T22:36:07.395812Z"}, {"uuid": "07de31d6-8a4b-4d78-ae71-3f045cdc7986", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73550", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2mdvzic22k", "content": "\ud83d\udfe0 CVE-2026-73550 - High (7.5)\n\nEnvoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73550/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-21T21:03:11.337996Z"}, {"uuid": "461bcf21-a0dd-4e78-bb19-f75790096976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73552", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2me5jmyv2o", "content": "\ud83d\udfe0 CVE-2026-73552 - High (7.5)\n\nEnvoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-73552/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-21T21:03:19.164906Z"}]}