CVE-2025-62164
published 2025-11-21CVE-2025-62164: vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead…
PriorityP359high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.89%
57.1th percentile
vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of-service) and potentially remote code execution (RCE), exists in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM. This issue has been patched in version 0.11.1.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rhaiis | vllm-neuron-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| vllm-project | vllm | — | — |
| vllm | vllm | — | — |
| vllm | vllm | >= 0.10.2 < 0.13.0 | 0.13.0 |
| vllm | vllm | >= 0.10.2 < 0.11.1 | 0.11.1 |
| vllm | vllm | >= 0.10.2 < 0.13.0 | 0.13.0 |
| vllm | vllm | >= 0.10.2 < 0.11.1 | 0.11.1 |
| vllm | vllm | >= 0.21.0 < 0.26.0 | 0.26.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
ghsa·2026-09-04·CVSS 8.8
CVE-2026-73557 [HIGH] CWE-362 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
## Executive Summary
The follow-up protection for CVE-2025-62164 is incomplete at vLLM revision `26587f9519e22a5c4549ead7595ad9ca3229c4fd`. It wraps serialized prompt-embedding reconstruction and dense conversion in `torch.sparse.check_sparse_tensor_invariants()`, but PyTorch 2.11.0 implements that context with save/enable/restore operations over process-global state. Two prompt-embedding parts in one `/v1/chat/completions` request are gathered concurrently on the event loop's default executor. When one context exits before the other loads its tensor, it can restore the global flag to `False` while the second part remains inside its guard.
In a deterministic run against hash-verified source from the a
GHSA
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing.
ghsa_unreviewed·2026-06-20·CVSS 8.8
CVE-2026-56340 [HIGH] CWE-20 vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing.
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.
OSV
vLLM introduced enhanced protection for CVE-2025-62164
osv·2026-01-08·CVSS 8.8
CVE-2025-62164 [HIGH] vLLM introduced enhanced protection for CVE-2025-62164
vLLM introduced enhanced protection for CVE-2025-62164
### Summary
The fix [here](https://github.com/vllm-project/vllm/pull/27204) for CVE-2025-62164 is not sufficient. The fix only disables prompt embeds by default rather than addressing the root cause, so the DoS vulnerability remains when the feature is enabled.
### Details
vLLM's pending change attempts to fix the root cause, which is the missing sparse tensor validation. PyTorch (~v2.0) disables sparse tensor validation (specifically, sparse tensor invariants checks) by default for performance reasons. vLLM is adding the sparse tensor validation to ensure indices are valid, non-negative, and within bounds. These checks help catch malformed tensors.
### PoC
NA
### Impact
Current fix only added a flag to disable/enable prompt embeds
GHSA
vLLM introduced enhanced protection for CVE-2025-62164
ghsa·2026-01-08·CVSS 8.8
CVE-2025-62164 [HIGH] CWE-123 vLLM introduced enhanced protection for CVE-2025-62164
vLLM introduced enhanced protection for CVE-2025-62164
### Summary
The fix [here](https://github.com/vllm-project/vllm/pull/27204) for CVE-2025-62164 is not sufficient. The fix only disables prompt embeds by default rather than addressing the root cause, so the DoS vulnerability remains when the feature is enabled.
### Details
vLLM's pending change attempts to fix the root cause, which is the missing sparse tensor validation. PyTorch (~v2.0) disables sparse tensor validation (specifically, sparse tensor invariants checks) by default for performance reasons. vLLM is adding the sparse tensor validation to ensure indices are valid, non-negative, and within bounds. These checks help catch malformed tensors.
### PoC
NA
### Impact
Current fix only added a flag to disable/enable prompt embeds
GHSA
vLLM deserialization vulnerability leading to DoS and potential RCE
ghsa·2025-11-20
CVE-2025-62164 [HIGH] CWE-123 vLLM deserialization vulnerability leading to DoS and potential RCE
vLLM deserialization vulnerability leading to DoS and potential RCE
### Summary
A memory corruption vulnerability that leading to a crash (denial-of-service) and potentially remote code execution (RCE) exists in vLLM versions 0.10.2 and later, in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation.
Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM.
### Details
A vulnerability t
OSV
vLLM deserialization vulnerability leading to DoS and potential RCE
osv·2025-11-20
CVE-2025-62164 [HIGH] vLLM deserialization vulnerability leading to DoS and potential RCE
vLLM deserialization vulnerability leading to DoS and potential RCE
### Summary
A memory corruption vulnerability that leading to a crash (denial-of-service) and potentially remote code execution (RCE) exists in vLLM versions 0.10.2 and later, in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation.
Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM.
### Details
A vulnerability t
Red Hat
vllm: vLLM: Incomplete remediation allows bypass via concurrent prompt processing
vendor_redhat·2026-08-13·CVSS 8.8
CVE-2026-73557 [HIGH] CWE-367 vllm: vLLM: Incomplete remediation allows bypass via concurrent prompt processing
vllm: vLLM: Incomplete remediation allows bypass via concurrent prompt processing
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.
A flaw was found in vLLM, an inference and serving engine for large language models. An incomplete remediation fo
Red Hat
vllm: vLLM: Denial of service and potential arbitrary code execution via malformed multimodal embedding requests
vendor_redhat·2026-06-20·CVSS 8.8
CVE-2026-56340 [HIGH] CWE-787 vllm: vLLM: Denial of service and potential arbitrary code execution via malformed multimodal embedding requests
vllm: vLLM: Denial of service and potential arbitrary code execution via malformed multimodal embedding requests
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.
A flaw was found in vLLM. This vulnerability allows a remote attacker to trigger crashes or resourc
Red Hat
vllm: VLLM deserialization vulnerability leading to DoS and potential RCE
vendor_redhat·2025-11-21·CVSS 8.8
CVE-2025-62164 [HIGH] CWE-787 vllm: VLLM deserialization vulnerability leading to DoS and potential RCE
vllm: VLLM deserialization vulnerability leading to DoS and potential RCE
vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of-service) and potentially remote code execution (RCE), exists in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to cod
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73557 vllm: vLLM: Incomplete remediation allows bypass via concurrent prompt processing
bugzilla·2026-08-13·CVSS 8.8
CVE-2026-73557 [HIGH] CVE-2026-73557 vllm: vLLM: Incomplete remediation allows bypass via concurrent prompt processing
CVE-2026-73557 vllm: vLLM: Incomplete remediation allows bypass via concurrent prompt processing
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0.
Bugzilla
CVE-2026-56340 vllm: vLLM: Denial of service and potential arbitrary code execution via malformed multimodal embedding requests
bugzilla·2026-06-20·CVSS 8.8
CVE-2026-56340 [HIGH] CVE-2026-56340 vllm: vLLM: Denial of service and potential arbitrary code execution via malformed multimodal embedding requests
CVE-2026-56340 vllm: vLLM: Denial of service and potential arbitrary code execution via malformed multimodal embedding requests
vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.
Wiz
GHSA-mcmc-2m55-j8jj Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2025-62164 [HIGH] GHSA-mcmc-2m55-j8jj Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-mcmc-2m55-j8jj :
vLLM vulnerability analysis and mitigation
## Summary
The fix here for CVE-2025-62164 is not sufficient. The fix only disables prompt embeds by default rather than addressing the root cause, so the DoS vulnerability remains when the feature is enabled.
## Details
vLLM's pending change attempts to fix the root cause, which is the missing sparse tensor validation. PyTorch (~v2.0) disables sparse tensor validation (specifically, sparse tensor invariants checks) by default for performance reasons. vLLM is adding the sparse tensor validation to ensure indices are valid, non-negative, and within bounds. These checks help catch malformed tensors.
## PoC
NA
## Impact
Current fix only added a flag to disable/enable prompt embeds, so by default, prompt embeds
2025-11-21
Published