PT-2025-47649 · Vllm · Vllm

Published 2025-11-20 · Updated 2025-12-04 · CVE-2025-62372

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions vLLM versions 0.5.5 through 0.11.0

Description vLLM is an inference and serving engine for large language models (LLMs). Users can cause the vLLM engine to crash when serving multimodal models by providing multimodal embedding inputs with a correct number of dimensions (ndim) but an incorrect shape, such as a wrong hidden dimension. This occurs regardless of whether the model is designed to handle such inputs.

Recommendations Update to version 0.11.1 or later.

Exploit

Fix

DoS

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

BDU:2025-14667

CVE-2025-62372

GHSA-PMQF-X6X8-P7QW

Affected Products

Vllm

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62372.json · Exploit
• https://github.com/vllm-project/vllm/pull/27204 · Vendor Advisory
• https://github.com/vllm-project/vllm/security/advisories/GHSA-pmqf-x6x8-p7qw · Vendor Advisory
• https://github.com/vllm-project/vllm/commit/58fab50d82838d5014f4a14d991fdb9352c9c84b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62372 · Security Note
• https://osv.dev/vulnerability/GHSA-pmqf-x6x8-p7qw · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14667 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62372 · Vendor Advisory
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/pull/6613 · Note
• https://twitter.com/CVEnew/status/1991729598510559452 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p2z55i/resumen_diario_de_vulnerabilidades_21112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p2foxr/resumen_diario_de_vulnerabilidades_20112025 · Reddit Post
• https://t.me/cveNotify/144760 · Telegram Post
• https://t.me/cveNotify/143522 · Telegram Post