PYSEC-2026-3935
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-3935.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3935
- Aliases
- Published
- 2026-09-10T09:45:00Z
- Modified
- 2026-09-10T12:15:15Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- vLLM: Cross-User Data Leak Vulnerability
- Details
-
Summary
An integer overflow in the act_and_mul_kernel kernel can cause the output of one user request to be incorporated into the response of another request within the same inference batch. Under certain conditions, the last request in a batch can receive a partial or complete copy of the first user's inference result, resulting in cross-user data leakage.
Details
The root cause is an integer overflow in the expression blockIdx.x * 2 * d at https://github.com/vllm-project/vllm/blob/ff712f6447093d07747c88680b9d006b119f5890/csrc/activation_kernels.cu#L82.
As a result, the computation for one user (User A) can incorrectly consume input data from another user (User B). In particular, when 2^32 is divisible by d, the overflow can cause User A's output to contain portions of User B's inference result. In some cases, User B's response may be copied entirely into User A's response.
This constitutes a severe cross-user information disclosure vulnerability and is straightforward to trigger.
PoC
We reproduced the issue using meta-llama/Llama-3.2-1B-Instruct, for which d = 8192.
Using the following configuration:
Batch size: 17 Sequence length: 16384
The final response in the batch becomes an exact copy of the first response in the batch, demonstrating complete cross-user data leakage.
Impact
This vulnerability enables cross-user information disclosure. An attacker can intentionally craft requests that are processed within the same inference batch as a victim's request and cause the victim's inference output to be copied into the attacker's response.
As a result, sensitive information contained in another user's model response may be exposed to an unauthorized party.
Versions
For versions prior and equal to 0.21.0, the bug is in csrc/activation_kernels.cu, and for versions later than 0.21.0, the bug is in csrc/libtorch_stable/activation_kernels.cu.
- References
-
- https://github.com/vllm-project/vllm/security/advisories/GHSA-7m6h-x95x-82q5
- https://nvd.nist.gov/vuln/detail/CVE-2026-73558
- https://github.com/vllm-project/vllm/issues/42860
- https://github.com/vllm-project/vllm/pull/49660
- https://github.com/vllm-project/vllm/commit/451227cb3ff07989698fed982c2d3e4300257924
- https://github.com/vllm-project/vllm
- https://github.com/vllm-project/vllm/releases/tag/v0.27.0
- https://pypi.org/project/vllm
- https://github.com/advisories/GHSA-7m6h-x95x-82q5
Affected packages
PyPI / vllm
Package
- Name
- vllm
- View open source insights on deps.dev
- Purl
- pkg:pypi/vllm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.27.0