# CVE-2025-62164: vLLM unsafe deserialization in Completions API prompt embeddings

Source: https://junglewise.ai/threats/cve-2025-62164-vllm-unsafe-deserialization-in-completions-api-prompt-embeddings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-21. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2025-62164 · Severity: high · CVSS 8.8 · Published 2025-11-21

vLLM is a high-performance engine for serving artificial intelligence models. A security flaw in its Completions API allows an attacker to send specially crafted data that can crash the server or potentially allow them to run unauthorized commands on the host system. This could lead to a total service outage or the theft of sensitive data processed by the AI engine.

Technologies: [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm), [Vllm](https://junglewise.ai/threats/technologies/vllm), [vLLM Project vllm](https://junglewise.ai/threats/technologies/vllm-project-vllm). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Vllm](https://junglewise.ai/threats/vendors/vllm), [vLLM Project](https://junglewise.ai/threats/vendors/vllm-project).

## Quick answers

**Is CVE-2025-62164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62164 being exploited in the wild.

**How severe is CVE-2025-62164?** High severity, with a CVSS score of 8.8, published 21 November 2025.

**Which products and versions are affected?** vllm (PyPI) ECOSYSTEM:introduced=0.10.2,fixed=0.11.1; vLLM Project vllm >= 0.10.2, < 0.11.1.

**Is there a fix for CVE-2025-62164?** Yes. vllm (PyPI): upgrade to 0.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-62164 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-62164?** Check whether you run vllm (PyPI), Vllm or vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vllm (PyPI): upgrade to 0.11.1 or later

  ```sh
  pip install "vllm>=0.11.1"
  ```


## Technical details

A vulnerability exists in vLLM's Completions API endpoint due to the unsafe use of torch.load() when processing user-supplied prompt embeddings. Starting with PyTorch 2.8.0, sparse tensor integrity checks are disabled by default during deserialization. An attacker with API access can provide a maliciously crafted sparse tensor that bypasses internal bounds checks, triggering an out-of-bounds memory write when the 'to_dense()' method is called. This can result in a denial-of-service (DoS) via process crash or remote code execution (RCE). The issue is addressed in version 0.11.1 by ensuring proper validation of tensor invariants.

## Affected products

- vLLM Project vllm >= 0.10.2, < 0.11.1

## Identifiers

- CVE-2025-62164
- GHSA-mrw7-hf4f-83pf
- PYSEC-2026-2018

## Timeline

- 2025-11-20: advisory: GitHub Advisory GHSA-mrw7-hf4f-83pf published
- 2025-11-20: patched: Fix merged in vLLM pull request 27204

## References

- [https://api.github.com/users/omriaxion](https://api.github.com/users/omriaxion)
- [https://github.com/omriaxion](https://github.com/omriaxion)
- [https://api.github.com/users/omriaxion/gists%7B/gist_id%7D](https://api.github.com/users/omriaxion/gists%7B/gist_id%7D)
- [https://api.github.com/users/omriaxion/repos](https://api.github.com/users/omriaxion/repos)
- [https://avatars.githubusercontent.com/u/213585164?v=4](https://avatars.githubusercontent.com/u/213585164?v=4)
- [https://api.github.com/users/omriaxion/events%7B/privacy%7D](https://api.github.com/users/omriaxion/events%7B/privacy%7D)

## Related threats

- [vLLM chat template resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-115918-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://junglewise.ai/threats/cve-2026-115917-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM off-by-one error in tokenizer max_token_id validation](https://junglewise.ai/threats/cve-2026-115916-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM image format validation bypass in media processing](https://junglewise.ai/threats/cve-2026-115915-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM denial of service in DeepSeek-OCR image processing](https://junglewise.ai/threats/cve-2026-115914-vllm-is-an-inference-and-serving-engine-for-large-language)