vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-pmqf-x6x8-p7qw | vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 21 Nov 2025 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1. | |
| Title | vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs | |
| Weaknesses | CWE-129 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-11-21T01:22:37.121Z
Reserved: 2025-10-10T14:22:48.204Z
Link: CVE-2025-62372
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-21T02:15:43.393
Modified: 2025-11-21T02:15:43.393
Link: CVE-2025-62372
Redhat
No data.
OpenCVE Enrichment
No data.