CVE-2025-62372: vllm-project vllm Improper Validation of Array Index
Vulnerability summary
CVE-2025-62372 is a high (CVSS 8.3) Improper Validation of Array Index vulnerability in vllm-project vllm. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 21-11-2025PublishedVulnerability first disclosed.
- 24-11-2025Last modifiedVulnerability information updated.
Description
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can crash the vLLM engine serving multimodal models by passing multimodal embedding inputs with correct ndim but incorrect shape (e.g. hidden dimension is wrong), regardless of whether the model is intended to support such inputs (as defined in the Supported Models page). This issue has been patched in version 0.11.1.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- OSV · ChainguardEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- NVDNIST8.3HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- tritonserver-backend-vllm-meta-cuda-12.9< 25.9.0_git20251112-r1
PyPI1 product
- vllm≥ 0.5.5, < 0.11.1
Vllm1 product
- vllm≥ 0.5.5, < 0.11.1 | 0.11.1:rc0 | 0.11.1:rc1
Vllm-project1 product
- vllm≥ 0.5.5, < 0.11.1
4 vendors · 4 products
References
10 links- github.com/vllm-project/vllm/security/advisories/GHSA-pmqf-x6x8-p7qwX Refsource CONFIRMWEBAdvisoryMitigationVendor Advisory
- github.com/vllm-project/vllm/commit/58fab50d82838d5014f4a14d991fdb9352c9c84bX Refsource MISCWEBFIXPatch
- github.com/vllm-project/vllmPACKAGE