CVE-2025-46560

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens...

CVE-2025-46560

CVE-2025-46560 affects vLLM 0.8.0–0.8.4, where the multimodal tokenizer’s input preprocessing uses placeholder tokens replaced by repeated tokens. The replacement logic relies on inefficient list concatenation, yielding quadratic time complexity (O(n²)) and enabling resource exhaustion via crafte...

CVE-2025-30202

CVE-2025-30202 affects vLLM versions 0.5.2 up to 0.8.4 (prior to 0.8.5) in multi-node deployments. The root cause is an XPUB ZeroMQ socket bound to ALL interfaces on the primary host used for tensor parallelism, which can be accessed by any client with network access. This allows potential data e...