CVE-2025-62164: vLLM unsafe deserialization in Completions API prompt embeddings

Executive brief

vLLM is a high-performance engine for serving artificial intelligence models. A security flaw in its Completions API allows an attacker to send specially crafted data that can crash the server or potentially allow them to run unauthorized commands on the host system. This could lead to a total service outage or the theft of sensitive data processed by the AI engine.

Technical details

A vulnerability exists in vLLM's Completions API endpoint due to the unsafe use of torch.load() when processing user-supplied prompt embeddings. Starting with PyTorch 2.8.0, sparse tensor integrity checks are disabled by default during deserialization. An attacker with API access can provide a maliciously crafted sparse tensor that bypasses internal bounds checks, triggering an out-of-bounds memory write when the 'to_dense()' method is called. This can result in a denial-of-service (DoS) via process crash or remote code execution (RCE). The issue is addressed in version 0.11.1 by ensuring proper validation of tensor invariants.

Affected products

• vLLM Project vllm >= 0.10.2, < 0.11.1

Timeline

• 2025-11-20: advisory: GitHub Advisory GHSA-mrw7-hf4f-83pf published
• 2025-11-20: patched: Fix merged in vLLM pull request 27204

References

• https://api.github.com/users/omriaxion
• https://github.com/omriaxion
• https://api.github.com/users/omriaxion/gists%7B/gist_id%7D
• https://api.github.com/users/omriaxion/repos
• https://avatars.githubusercontent.com/u/213585164?v=4
• https://api.github.com/users/omriaxion/events%7B/privacy%7D