CVE-2025-62372: vLLM Engine DoS Vulnerability

CVE-2025-62372 Overview

CVE-2025-62372 is a denial-of-service vulnerability in vLLM, an inference and serving engine for large language models (LLMs). The flaw affects vLLM versions from 0.5.5 up to but not including 0.11.1. Authenticated users can crash the vLLM engine by submitting multimodal embedding inputs with a correct ndim but an incorrect shape, such as a mismatched hidden dimension. The issue affects any deployment serving multimodal models, regardless of whether the model was intended to accept embedding inputs. The vulnerability maps to [CWE-129: Improper Validation of Array Index]. Maintainers patched the flaw in version 0.11.1.

Critical Impact
Any authenticated client can terminate the vLLM inference engine with a single malformed multimodal embedding request, disrupting service availability for all tenants sharing the endpoint.

Affected Products

vLLM versions 0.5.5 through 0.11.0
vLLM 0.11.1-rc0 (release candidate)
vLLM 0.11.1-rc1 (release candidate)

Discovery Timeline

2025-11-21 - CVE-2025-62372 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62372

Vulnerability Analysis

vLLM exposes an HTTP API that accepts multimodal inputs, including pre-computed embedding tensors for models such as vision-language transformers. The frontend validates the number of dimensions (ndim) on incoming embedding tensors but does not verify that the tensor shape matches the model's expected hidden dimension. When a client submits an embedding whose ndim is correct but whose hidden size or sequence layout is wrong, the tensor propagates into the model forward pass where a shape mismatch triggers an unhandled exception that crashes the serving process.

Because vLLM is typically deployed as a long-running inference server behind a load balancer, a single crash terminates in-flight requests for every connected client. Restart cycles amplify the availability impact for shared inference infrastructure.

Root Cause

The root cause is incomplete input validation on multimodal embedding tensors in the request handling path. The frontend accepts embedding inputs from any authenticated user without gating this behavior behind an explicit configuration flag. Any model serving path that touches multimodal preprocessing can reach the vulnerable code, even when the loaded model is not documented as supporting raw embedding inputs.

Attack Vector

An attacker requires network access to the vLLM API and low-privilege authentication. The attacker sends a crafted request containing a multimodal embedding field with a valid tensor rank but a malformed inner shape. The engine attempts to feed the tensor through the model, encounters a shape assertion or CUDA error, and terminates. The attack requires no user interaction and no elevated privileges.

python

# Security patch: examples/offline_inference/prithvi_geospatial_mae.py
            dtype="float16",
            enforce_eager=True,
            model_impl="terratorch",
+           enable_mm_embeds=True,
        )

    def run(self, input_data, location_coords):

The patch introduces a new enable_mm_embeds flag. The engine now rejects multimodal embedding inputs unless the operator explicitly opts in at model load time, reducing the attack surface for deployments that do not need this capability. Source: vLLM commit 58fab50d.

Detection Methods for CVE-2025-62372

Indicators of Compromise

Unexpected termination of the vLLM server process followed by container or supervisor-driven restarts.
API error responses referencing tensor shape mismatches, RuntimeError, or CUDA assertion failures immediately preceding process exit.
Repeated multimodal API requests from a single client containing embedding tensors with anomalous inner dimensions.

Detection Strategies

Parse vLLM stderr and stdout logs for RuntimeError, AssertionError, and shape-mismatch traces originating in model forward calls.
Correlate process restart events from the orchestrator (Kubernetes, systemd, Docker) with inbound API request patterns to identify likely trigger requests.
Alert on request payloads whose embedding shapes deviate from the loaded model's declared hidden dimension.

Monitoring Recommendations

Track vLLM process uptime and restart counts as availability service level indicators.
Log request identifiers, source addresses, and payload shapes for every multimodal request to support post-incident forensics.
Rate-limit multimodal embedding submissions per authenticated principal to blunt abusive traffic.

How to Mitigate CVE-2025-62372

Immediate Actions Required

Upgrade vLLM to version 0.11.1 or later on every inference node serving multimodal models.
Audit deployment manifests to confirm the enable_mm_embeds flag is set only where operators intentionally accept client-provided embeddings.
Restrict network access to the vLLM API to authenticated internal services or a dedicated gateway.

Patch Information

The fix is delivered in vLLM 0.11.1 through pull request #27204 and commit 58fab50d. Full advisory details are published as GHSA-pmqf-x6x8-p7qw. The patch requires operators to opt in to multimodal embedding inputs via enable_mm_embeds=True and adds shape validation on tensors that reach the model.

Workarounds

Place vLLM behind a reverse proxy that strips or rejects multi_modal_data embedding fields for endpoints that do not require them.
Deploy per-tenant authentication and quota enforcement to limit the blast radius of a crash-triggering client.
Run vLLM under a process supervisor with rapid restart and health checks, and isolate multimodal workloads on dedicated replicas to contain availability impact.

bash

# Pin vLLM to a patched version
pip install --upgrade 'vllm>=0.11.1'

# Verify the running version
python -c "import vllm; print(vllm.__version__)"

# Launch server without accepting client-supplied multimodal embeddings
vllm serve <model> --disable-log-requests