NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

CVE-2025-62372 — vllm

Fix: vllm-project/vllm@58fab50

CVE-2025-62372 is a CWE-129 vulnerability in vllm. A fix is available for vllm — see the affected versions and patch details below.

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

Also known asGHSA-pmqf-x6x8-p7qwPYSEC-2026-2019
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-62372.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk+0.03%
Lower risk than most CVEs35th percentile — riskier than 35% of all scored CVEsHighest risk
0.00%0.30%0.61%0.91%0.1%0.4%May 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐍vllm

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page).

The issue has existed ever since we added support for image embedding inputs, i.e. #6613 (released in v0.5.5)

Details

Using image embeddings as an example:

  • For models that support image embedding inputs, the engine crashes when scattering the embeddings to inputs_embeds (mismatched shape)
  • For models that don't support image embedding inputs, the engine crashes when validating the inputs inside get_input_embeddings (validation fails).

This happens because we only validate ndim of the tensor, but not the full shape, in input processor (via MultiModalDataParser).

Impact

  • Denial of service by crashing the engine

Mitigation

  • Use API key to limit access to trusted users.
  • Set --limit-mm-per-prompt to 0 for all non-text modalities to ban multimodal inputs, which includes multimodal embedding inputs. However, the model would then only accept text, defeating the purpose of using a multi-modal model.

Resolution

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIvllm≥ 0.5.5&&< 0.11.10.11.1pip install --upgrade 'vllm==0.11.1'

Affected Products

1 product · 3 configurations
Application
vllmvllm
≥ 0.5.5 && < 0.11.1
1 version
0.11.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for vllm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update vllm to 0.11.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-62372 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This flaw is rated Moderate rather than Important because its impact is strictly limited to availability and requires low but existing privileges to exploit. The issue arises from incomplete shape validation of multimodal embedding tensors, which can cause deterministic crashes in the inference engine, but it does not…

Workaround published by Red Hat
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Source: Red Hat security advisory for CVE-2025-62372 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat AI Inference Server 3.2rhaiis/vllm-cuda-rhel9:3.2.5-1765552580RHSA-2025:23204
Red Hat AI Inference Server 3.2rhaiis/vllm-rocm-rhel9:3.2.5-1765361180RHSA-2025:23205
Red Hat AI Inference Server 3.2rhaiis/vllm-tpu-rhel9:3.2.5-1765552619RHSA-2025:23209
Red Hat AI Inference Server 3.2rhaiis/vllm-rocm-rhel9:3.2.5-1765552603RHSA-2025:23449
Red Hat AI Inference Server 3.2rhaiis/vllm-cuda-rhel9:1772160593RHSA-2026:3461
Red Hat AI Inference Server 3.2rhaiis/vllm-rocm-rhel9:1772160625RHSA-2026:3462

Frequently Asked Questions

### Summary Users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct `ndim` but incorrect `shape` (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). The issue has existed ever since we added support for image embedding inputs, i.e. #6613 (released in v0.5.5) ### Details Using image embeddings as an example: - For models that support image embedding inputs, the engine crashes when scattering the embeddings to `inputs_embeds` (mismatched shape) -
O3 Security · Impact-Aware SCA

Is CVE-2025-62372 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2025-62372: vllm DoS — Fixed in 0.11.1