Improper validation of array index in vLLM - CVE-2025-62372

Vulnerability details

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when handling multimodal embeddings. A remote user can send multimodal embedding inputs with correct ndim but incorrect shape, regardless of whether the model is intended to support such inputs and perform a denial of service attack. 

Affected software

How to mitigate CVE-2025-62372

External References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-pmqf-x6x8-p7qw
• https://github.com/vllm-project/vllm/security/advisories/GHSA-wv77-2vpf-vmmg

Related Security Bulletins

• Multiple vulnerabilities in vLLM
• Multiple vulnerabilities in Red Hat AI Inference Server (TPU)
• Multiple vulnerabilities in Red Hat AI Inference Server (CUDA)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)
• Multiple vulnerabilities in Red Hat AI Inference Server (ROCm)