Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2025-71379 vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities

Description

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

Produits et versions touchés

Produit Versions touchées Corrigé en
vLLM 0.9 premières → < 0.9.0 0.9.0
vLLM 0.6 0.6.3 → < 0.9.0 0.9.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de vLLM

Les 2 CVE de vLLM →
CVE-2026-56340 vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing 8.7 Élevée
Suivre cette CVE