Skip to content
fr Sign in
5.3 Medium

CVE-2025-71379 vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities

Description

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

Affected products and versions

Product Affected versions Fixed in
vLLM 0.9 earliest → < 0.9.0 0.9.0
vLLM 0.6 0.6.3 → < 0.9.0 0.9.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vLLM

The 2 CVEs of vLLM →
CVE-2026-56340 vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing 8.7 High
Track this CVE