CVE-2025-71379: vllm, отказ на услуга

Описание

Оригинално описание

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

Засегнати продукти

• vllm vllm: 0.6.3 преди 0.9.0; 0.9.0

Вид слабост

• CWE-1333 Inefficient Regular Expression Complexity

История

Други уязвимости в vllm vllm

• 8.8CVE-2026-56340

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2025-71379
• https://nvd.nist.gov/vuln/detail/CVE-2025-71379
• https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp
• https://www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-components