CVE-2025-62372CWE-129

CVE-2025-62372

Medium · published November 21, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.1th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2025-11-21T07:15Z
Affected products (3)
ProductVersionsFixed in
vllm/vllm≥ 0.5.5, < 0.11.10.11.1
vllm/vllmall versions—
vllm/vllmall versions—
References (4)
EPSS history
Timeline
  • 21 NOV 01:22Z
    vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs
    cvelistv5