Information Disclosure in vLLM Inference Engine by vLLM Project

CVE-2026-53923

What is CVE-2026-53923?

The vLLM inference engine, used for processing large language models, is susceptible to an information disclosure vulnerability due to integer truncation of tensor dimensions in its GGUF dequantize kernels. This flaw allows for the uninitialized portion of output tensors to contain residual data from previous GPU memory allocations. In multi-tenant environments, this can inadvertently expose sensitive tensor data from one user's inference requests to others. The vulnerability has been addressed in the updates from version 0.23.1rc0.

References