CVE-2025-71379
⚪ Do wiadomości
Wielokrotne podatności ReDoS w vLLM mogą prowadzić do odmowy usługi przez nadmierne zużycie CPU.
CVSS
4.3
EPSS
0.5%
Exploit
poc
Vendor
vllm
Opis źródłowy (NVD)
vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.
dos exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 4.3 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.5% |
| Opublikowano (NVD) | 2026-06-20 19:16:23 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-05 16:10:00 UTC |
Referencje
- https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp ([email protected]) [Exploit, Vendor Advisory]
- https://www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-components ([email protected]) [Third Party Advisory]