CVE-2025-48887

CVE-2025-48887 affects vLLM command/tool parsing: the ReDoS vulnerability is in vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py for versions 0.6.4 through 0.9.0 (exclusive) . The root cause is a highly complex, nested regex used for tool call detection, enabling catastrophic backtrac...

CVE-2025-48887 vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`

vLLM, an inference and serving engine for large language models LLMs, has a Regular Expression Denial of Service ReDoS vulnerability in the file vllm/entrypoints/openai/toolparsers/pythonictoolparser.py of versions 0.6.4 up to but excluding 0.9.0. The root cause is the use of a highly complex and...

GHSA-J828-28RJ-HFHP vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

GHSA-9HCF-V7M4-6M2J vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

CVE-2025-46722 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

GHSA-4QJH-9FV9-R85R vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

GHSA-C65P-X677-FGJ6 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

GHSA-VRQ3-R879-7M65 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

GHSA-W6Q7-J642-7C25 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

CVE-2025-46570 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm, py3.10-vllm-cuda-11.8...

vLLM 安全漏洞

vLLM is a high throughput and memory efficient inference and service engine for LLM from the vLLM open source. A security vulnerability exists in vLLM versions prior to 0.8.0 through 0.9.0, which stems from the fact that supplying an invalid regular expression when using structured output may...

CVE-2025-48943: Uncaught Exception

vLLM is an inference and serving engine for large language models LLMs. Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service ReDoS that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to...

CVE-2025-48944: Improper Input Validation

vLLM is an inference and serving engine for large language models LLMs. In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality ...

CVE-2025-48942: Uncaught Exception

vLLM is an inference and serving engine for large language models LLMs. In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid jsonschema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex...

CVE-2025-48887: Inefficient Regular Expression Complexity

vLLM, an inference and serving engine for large language models LLMs, has a Regular Expression Denial of Service ReDoS vulnerability in the file vllm/entrypoints/openai/toolparsers/pythonictoolparser.py of versions 0.6.4 up to but excluding 0.9.0. The root cause is the use of a highly complex and...

CVE-2025-46570

vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT Time to First Token. These timing differences...

CVE-2025-46722

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

PYSEC-2025-43

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

Timing Attack

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Timing Attack due to the PageAttention mechanism. An attacker can observe timing differences to infer details about the processed data by analyzing...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...