CVE-2026-53923

Summary

vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving

Severity

medium

EPSS

0.5% (p40)

Also known as

GHSA-5jv2-g5wq-cmr4

Published

2026-06-17

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-5jv2-g5wq-cmr4
• https://github.com/vllm-project/vllm/pull/44971
• https://github.com/vllm-project/vllm/commit/f219788f91952827132fa4fdf916427cd20d225e

Related advisories

• CVE-2026-48746 — critical · PyPI/vllm
• CVE-2026-22778 — critical · PyPI/vllm
• CVE-2025-47277 — critical · PyPI/vllm
• CVE-2025-32444 — critical · PyPI/vllm
• GHSA-ggpf-24jw-3fcw — critical · PyPI/vllm
• CVE-2024-9052 — critical · PyPI/vllm
• CVE-2024-9053 — critical · PyPI/vllm
• CVE-2024-11041 — critical · PyPI/vllm

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity