PT-2025-34225 · Vllm · Vllm
Jperezdealgaba
·
Published
2025-08-21
·
Updated
2025-08-24
·
CVE-2025-48956
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
vLLM versions 0.1.0 through 0.10.1.0
Description:
vLLM is an inference and serving engine for large language models (LLMs). A Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint, resulting in server memory exhaustion and potential crashes or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user. The vulnerability leverages the abuse of HTTP headers, such as the
X-Forwarded-For header, by setting it to a very large value.Recommendations:
Upgrade to vLLM version 0.10.1.1 or later.
Use a proxy in front of vLLM which provides protection against this issue.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vllm