p PatchFirst

CVE-2025-46560

CVE-2025-46560 · vLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_|>, <|image_|>) with repeated tokens based on precomputed lengths. Due to ​​inefficient list concatenation operations​​, the algorithm exhibits ​​quadratic time complexity (O(n²))​​, allowing malicious actors to trigger resource exhaustion via specially crafted inputs. This issue has been patched in version 0.8.5.

CVSS 6.5 · Media · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • vllm

    Versiones
    • >= 0.8.0, < 0.8.5: Afectada

    Sin corrección publicada

  • vllm PyPI

    Versiones
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 0.8.0, < 0.8.5

    Actualiza a 0.8.5

Fuentes originales

Comprueba tu servidor →