p PatchFirst

CVE-2025-71379

CVE-2025-71379 · vllm - Regular Expression Denial of Service in Multiple Components

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • vllm

    Versions
    • ≥ 0.6.3, < 0.9.0: Affected (semver)
    • 0.9.0: Not affected (semver)

    Update to 0.9.0

  • vllm PyPI

    Versions
    • 0.6.3
    • 0.6.3.post1
    • 0.6.4
    • 0.6.4.post1
    • 0.6.5
    • 0.6.6
    • 0.6.6.post1
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 0.8.4
    • 0.8.5
    • 0.8.5.post1
    Affected ranges
    • ECOSYSTEM: ≥ 0.6.3, < 0.9.0

    Update to 0.9.0

Original sources

Check your server →