CVE-2025-62372: vLLM denial of service via malformed multimodal embedding inputs

Executive brief

vLLM is a high-performance engine used to run and serve large language models, including those that process images and other media. A vulnerability allows an attacker to crash the engine by sending specially formatted data that describes images or other media incorrectly. This results in a denial-of-service, making the AI service unavailable to all users until it is restarted.

Technical details

A vulnerability in vLLM's MultiModalDataParser allows for a denial-of-service via an engine crash. The root cause is insufficient validation of multimodal embedding inputs; the engine verifies the number of dimensions (ndim) but fails to validate the full shape of the tensor. When a model that supports image embeddings receives a tensor with a mismatched hidden dimension, the engine crashes during the scattering process to 'inputs_embeds'. For models that do not support such inputs, the crash occurs during validation within 'get_input_embeddings'. This can be triggered by any authenticated user with network access to the vLLM API. The issue is resolved in version 0.11.1.

Affected products

• vLLM Project vllm >= 0.5.5, < 0.11.1

Timeline

• 2025-11-20: disclosed
• 2025-11-20: advisory
• 2025-11-20: patched: Fixed in version 0.11.1

References

• https://api.github.com/users/DarkLight1337
• https://github.com/DarkLight1337
• https://api.github.com/users/DarkLight1337/gists%7B/gist_id%7D
• https://api.github.com/users/DarkLight1337/repos
• https://avatars.githubusercontent.com/u/44970335?v=4
• https://api.github.com/users/DarkLight1337/events%7B/privacy%7D