CVE-2025-62372: falha de alta gravidade em vllm-project vllm
vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.4%
probabilidade de exploração
0.4%top 70% das CVEs
exploração observada
nãonenhuma fonte reporta
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Produtos afetados
vllm-project · vllmCVEs relacionadas — vllm-project vllm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-22778CRITICALvLLM leaks a heap address when PIL throws an errorEPSS 11.2%CVE-2026-27893HIGHvLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-outEPSS 1.8%CVE-2025-32444CRITICALvLLM Vulnerable to Remote Code Execution via Mooncake IntegrationEPSS 1.8%CVE-2026-48746CRITICALvLLM: OpenAI auth bypassEPSS 1.2%CVE-2025-47277CRITICALvLLM Allows Remote Code Execution via PyNcclPipe Communication ServiceEPSS 1.0%CVE-2025-62164HIGHVLLM deserialization vulnerability leading to DoS and potential RCEEPSS 0.9%