High · published November 21, 2025
🚨 Memory corruption in vLLM could let an attacker crash servers or execute code remotely! ⚡ The Completions API is the vulnerable spot, and it’s time to act! Think of it like a computer that accepts faulty power cords. If the power goes haywire, it could cause the entire system to crash or fry components. That's precisely what happens when malicious tensors slip through unvalidated — they wreak havoc on the entire vLLM setup! An attacker could exploit this vulnerability to cause a denial-of-service, crashing the vLLM engine and potentially allowing them to run arbitrary code on the server. This could lead to unauthorized data access or manipulation, making it a major risk for anyone using this service.
Think of it like a computer that accepts faulty power cords. If the power goes haywire, it could cause the entire system to crash or fry components. That's precisely what happens when malicious tensors slip through unvalidated — they wreak havoc on the entire vLLM setup! The vulnerability arises from insufficient validation when processing user-supplied prompt embeddings via the Completions API. By loading serialized tensors using `torch.load()` without adequate checks, it allows for out-of-bounds memory writes due to disabled integrity checks in PyTorch 2.8.0, leading to potential crashes or remote code execution.
An attacker could exploit this vulnerability to cause a denial-of-service, crashing the vLLM engine and potentially allowing them to run arbitrary code on the server. This could lead to unauthorized data access or manipulation, making it a major risk for anyone using this service. Update vLLM to version 0.11.1 immediately to patch this vulnerability. Additionally, review and validate all tensor inputs to ensure strict integrity checks are in place. Regularly monitor for any updates from the vLLM project to stay secure. You've got this! With these steps, you'll keep your vLLM secure and running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| vllm/vllm | ≥ 0.10.2, < 0.11.1 | 0.11.1 |
| vllm/vllm | all versions | — |
| vllm/vllm | all versions | — |