CVE-2025-62372

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-62372

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62372.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-62372

Aliases

GHSA-pmqf-x6x8-p7qw

Related

CGA-h4cx-3c7w-789m

Published

2025-11-21T01:22:37.121Z

Modified

2026-04-10T05:32:59.440026Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator

Summary

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

Details

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1.

Database specific

{
    "cwe_ids": [
        "CWE-129"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62372.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/vllm-project/vllm

Affected ranges

Type: GIT
Repo: https://github.com/vllm-project/vllm
Events: Introduced

09c7792610ada9f88bbf87d32b472dd44bf23cc2

Fixed

439368496db48d8f992ba8c606a0c0b1eebbfa69

Affected versions

v0.*

v0.10.0

v0.10.0rc1

v0.10.0rc2

v0.10.1rc1

v0.10.2rc1

v0.10.2rc2

v0.11.0rc1

v0.11.1rc0

v0.11.1rc1

v0.11.1rc2

v0.11.1rc3

v0.11.1rc4

v0.11.1rc5

v0.11.1rc6

v0.5.5

v0.6.0

v0.6.1

v0.6.1.post1

v0.6.1.post2

v0.6.2

v0.6.3

v0.6.3.post1

v0.6.4

v0.6.4.post1

v0.6.5

v0.6.6

v0.6.6.post1

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.8.0rc1

v0.8.0rc2

v0.8.1

v0.8.2

v0.8.3rc1

v0.8.4

v0.9.0

v0.9.1

v0.9.1rc1

v0.9.1rc2

v0.9.2rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62372.json"