CVE-2025-71379

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Inefficient Regular Expression Complexity pada vllm. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

Rincian

Terbit di NVD

20 Juni 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp exploit · advisory vendor
• https://www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-components advisory pihak ketiga