vLLM Multimodal Embeddings: Sparse Tensor Validation Bypass Leading to DoS/RCE
Overview
vLLM versions 0.10.2 up to (but not including) 0.13.0 exhibit a critical security flaw in their handling of multimodal embeddings. Specifically, the system fails to properly validate sparse tensors when the prompt-embeds feature is enabled. By submitting specially crafted embedding requests, an attacker can exploit this lack of validation. The vulnerability lies in the ability to provide malformed tensor indices, such as negative values or indices that fall outside the expected bounds of the tensor. Since PyTorch, by default, does not enforce invariant checks for sparse tensors, these malformed indices can bypass security measures. This can lead to severe consequences, including application crashes, denial-of-service conditions due to resource exhaustion, and potentially more dangerous memory corruption vulnerabilities like out-of-bounds reads or write-what-where exploits. This issue is a regression or an incomplete fix for CVE-2025-62164, as the previous patch merely disabled the feature by default instead of rectifying the underlying validation issue.
Affected Systems
Testing Guide
1. Ensure you are running a vulnerable version of vLLM (0.10.2 <= version < 0.13.0). 2. Enable the `prompt-embeds` feature in your vLLM configuration. 3. Construct a malicious embedding request with negative or out-of-bounds indices within the sparse tensor data. 4. Send this request to the vLLM API. 5. Observe the vLLM service for crashes, unexpected behavior, or excessive resource consumption (CPU/memory). 6. If these symptoms occur, the system is likely affected.
Mitigation Steps
- Ensure the `prompt-embeds` feature is disabled if not strictly necessary. - Upgrade vLLM to version 0.13.0 or later. - Implement custom input validation for embedding requests, specifically checking tensor index ranges and values. - Monitor system resources for unusual spikes during embedding processing. - Review PyTorch sparse tensor handling configurations for additional security settings.
Patch Details
vLLM 0.13.0