PT-2025-18217 · Vllm · Vllm

D3Do-23 + 2 · Published 2025-04-29 · Updated 2025-04-30 · CVE-2025-46560

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions vLLM versions 0.8.0 through 0.8.4

Description The issue concerns a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. It is caused by inefficient list concatenation operations, resulting in quadratic time complexity (O(n²)), which allows malicious actors to trigger resource exhaustion via specially crafted inputs.

Recommendations For versions 0.8.0 through 0.8.4, update to version 0.8.5 to resolve the issue. As a temporary workaround, consider restricting the use of the multimodal tokenizer to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2026-03424

CVE-2025-46560

GHSA-VC6M-HM49-G9QG

Affected Products

Vllm

References · 15

• 🔥 https://github.com/vllm-project/vllm/security/advisories/GHSA-vc6m-hm49-g9qg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46560.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46560 · Security Note
• https://osv.dev/vulnerability/GHSA-vc6m-hm49-g9qg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46560 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03424 · Security Note
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/blob/8cac35ba435906fb7eb07e44fe1a8c26e8744f4e/vllm/model_executor/models/phi4mm.py#L1182-L1197 · Note
• https://twitter.com/VulmonFeeds/status/1917404982720028885 · Twitter Post
• https://t.me/cvetracker/22668 · Telegram Post
• https://twitter.com/transilienceai/status/1917431913339404397 · Twitter Post
• https://twitter.com/gothburz/status/1917553260019253319 · Twitter Post
• https://t.me/cvedetector/24063 · Telegram Post
• https://twitter.com/CVEnew/status/1917385211068965149 · Twitter Post
• https://twitter.com/transilienceai/status/1917431917571432805 · Twitter Post