Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2025-46560 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs

Description

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_|>, <|image_|>) with repeated tokens based on precomputed lengths. Due to ​​inefficient list concatenation operations​​, the algorithm exhibits ​​quadratic time complexity (O(n²))​​, allowing malicious actors to trigger resource exhaustion via specially crafted inputs. This issue has been patched in version 0.8.5.

Produits et versions touchés

Produit Versions touchées Corrigé en
vllm 0.8 0.8.0 → < 0.8.5 0.8.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de vllm

Les 121 CVE de vllm →
CVE-2026-115918 vLLM is an inference and serving engine for large language models 6.5 Moyenne CVE-2026-115917 vLLM is an inference and serving engine for large language models 3.4 Faible CVE-2026-115916 vLLM is an inference and serving engine for large language models 6.5 Moyenne CVE-2026-115915 vLLM is an inference and serving engine for large language models 8.1 Élevée
Suivre cette CVE