PT-2025-23224 · Vllm · Vllm
Kexinoh
·
Published
2025-05-21
·
Updated
2025-05-30
·
CVE-2025-48887
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
vLLM versions 0.6.4 through 0.9.0
Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the vLLM project, specifically in the file
vllm/entrypoints/openai/tool parsers/pythonic tool parser.py. The root cause is the use of a highly complex and nested regular expression for tool call detection, which can be exploited by an attacker to cause severe performance degradation or make the service unavailable. The pattern contains multiple nested quantifiers, optional groups, and inner repetitions, making it vulnerable to catastrophic backtracking. This can lead to Denial of Service (DoS), resource exhaustion, and potential broader system instability.Recommendations
For versions 0.6.4 through 0.9.0, update to version 0.9.0 or later, which contains a patch for the issue. As a temporary workaround, consider restricting access to the vulnerable
pythonic tool parser.py file until the update is applied. Avoid using the vulnerable regular expression pattern in the vllm/entrypoints/openai/tool parsers/pythonic tool parser.py file until the issue is resolved.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vllm