vLLM CVE-2025-62164 remediation bypass via concurrent prompt embeds

Vulnerability Overview Vulnerability Name: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts CVE ID: CVE-2025-73557 Severity: Moderate Affected Versions: >=0.21.0 Fixed Versions: >=0.26.0 Executive Summary The subsequent mitigation for CVE-2025-62164 was incomplete in the vLLM revision . It wrapped the serialization prompt-embedding reconstruction and dense conversion with . However, PyTorch 2.11.0 implements process-global state for serializable/deserializable operations. Two prompt-embedding parts are collected concurrently within a single request. When the first context exits, it restores the global flag to , while the second part loads tensors within its scope. In a deterministic run, against a hash-validated source, the actual target loader rejected an invalid sparse load as a negative control. The frozen chat tracker subsequently scheduled benign malicious payloads on and , observing the invariant flag disabled, along with indexed reconstructed via . For the declared shape , the process intercepted the target's call and operated on the invalid tensor. This primary trigger requires (disabled by default), but does not require , multimodal models, or . API authentication is optional in the stock server; middleware is only installed when a CLI or environment API key is provided. I rate this issue as Medium Severity P2. The proof demonstrates the bypass of subsequent protection, invalid sparse reconstruction, and guarded-sink reachability. Consequences such as crashes and memory corruption depend on assumptions regarding behaviors recorded in the published CVE; I did not perform unsafe operations, run a live server, measure race reliability, or establish code execution. Background CVE-2025-62164 / GHSA-mrw7-N44f-83p3 involves client-controlled serialized reaching the target and an invalid . The recommendation attributed this to memory corruption, denial of service, and potential code execution, historically used for exploitation. The fix timeline is important for understanding the regression: PR #27204, merge commit on 2025-10-22 introduced the gate, disabled by default. It did not include sparse invariant contexts. Commit on 2025-12-15 introduced additional protections for CVE-2025-62164 (#3049), adding process-global sparse-invariant content loading, type checking, and dense conversion. Refactor commit on 2026-01-31 moved the loader to while retaining the same content. Chat-content-part commit on 2026-05-01 introduced chat parts and concurrent single-request scheduling, as described above. Therefore, this report does not present corrupted sparse loads or signatures. It reports a different concurrent root cause and trigger: unsynchronized save/load/restore of process-global subsequent guards, accessible via this multi-part chat scheduler. The affected revision is PyTorch 2.11.0 in . My runtime verification used this exact version. Vulnerability Details The target performs protected operations at : The context is not request-local. With the global flag initially disabled, we can describe the interleaved validation: 1. Benign part A enters, saves , and enables the flag. 2. Malicious part B enters, saves , and enables the flag. 3. A completes its load and exits, restoring its saved value. 4. B remains lexically within its context but observes the actual global flag is . 5. B's reconstructs the corrupted sparse tensor. 6. The target reaches before later ranking, hidden layer, and dtype checks. The constraint limits deserialization types; it cannot compensate for the disabled sparse invariant check from another request. The complete stock action-to-sink chain, traced in the affected source, is: The prompt async helper is created without an explicit executor, so it uses the event loop's default executor. This path is separate from the renderer's configurable pool. The deterministic scheduler observed two prompt parts on two default executor threads; by default, it kept at one of the defaults. bypasses multimodal processing, with the tracker explicitly allowing this when ( ). Therefore, the primary trigger does not require a multimodal model or . The source also states that the async wrapper must be thread-safe ( ), while the target test acknowledges that the sparse flag is not thread-local and concurrent users might leak state ( ). Exploitability Analysis The following evidence labels separate what is demonstrated from residual conditions: This feature is documented for trusted users, which narrows the expected exposure. It is not a memory safety boundary; users authorized to submit embedding inputs should not be able to disable process-global invariants for concurrent work. The current run proof shows the same invalid sparse object can cross the guard and reach the historical sink. If executing that sink retains the behavior described in CVE-2025-62164, it could lead to denial of service or memory corruption for deployed PyTorch builds. This is conditional state impact, not a res

Goal Reached Thanks to every supporter — we hit 100%!

vLLM CVE-2025-62164 remediation bypass via concurrent prompt embeds

More from this source