CVE-2025-62164: A Deserialization Flaw in vLLM's Completions API
vLLM, one of the most widely deployed LLM inference servers, shipped a high-severity deserialization bug in its Completions API: crafted prompt embeddings could corrupt server memory even though the code used PyTorch's safe loading mode. What it is, who is exposed, why weights_only=True was not enough, and the fix.