UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62372

DoS with incorrect shape of multimodal embedding inputs

Severity
High 8.3
Published
20 Nov 2025
Last changed
19 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.11.1
Also known as
GHSA-pmqf-x6x8-p7qw
Sources
NVD, Project advisories (GitHub)

Description

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This…

Affected software

SoftwareAffected versions
vLLMServers and applications · cpe:a:vllm:vllm
  • From 0.5.5 before 0.11.1
  • Version 0.11.1-rc0
  • Version 0.11.1-rc1
vLLMServers and applications · github:vllm-project/vllm
  • From 0.5.5 before 0.11.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62372
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62372
  • GitHub Advisory Database https://github.com/advisories/GHSA-pmqf-x6x8-p7qw
  • github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-pmqf-x6x8-p7qw