CVE-2026-53923

vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The output tensor is allocated at full size via torch::empty (uninitialized memory), but the dequantize CUDA kernel processes only a truncated number of elements. The unfilled portion of the output tensor retains whatever was previously in GPU memory. In multi-tenant inference deployments, this residual GPU memory may contain tensor data from other users' inference requests, constituting information disclosure. This vulnerability is fixed in 0.23.1rc0.

• CWE-200
• CWE-681

• https://github.com/vllm-project/vllm/commit/f219788f91952827132fa4fdf916427cd20d225ePatch
• https://github.com/vllm-project/vllm/pull/44971Issue Tracking
• https://github.com/vllm-project/vllm/security/advisories/GHSA-5jv2-g5wq-cmr4Third Party Advisory

Published

Jun 22, 2026

Last Modified

Jun 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53913Improper Authentication, Missing Authentication for Critical…9.8
• CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possibl…9.8
• CVE-2026-53915In JetBrains GoLand before 2026.1.3 remote code execution wa…8.8
• CVE-2026-53916Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-53917Memory Allocation with Excessive Size Value vulnerability in…7.5
• CVE-2026-5392Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 me…5.4
• CVE-2026-53925Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-53926NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-53927NocoDB is software for building databases as spreadsheets. P…5.1
• CVE-2026-53928NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-53929NocoDB is software for building databases as spreadsheets. P…5.1
• CVE-2026-5393Dual-Algorithm CertificateVerify out-of-bounds read. When pr…9.1