PT-2026-51171 · Vllm · Vllm

Kexinoh + 2 · Published 2026-06-20 · Updated 2026-06-20 · CVE-2025-71379

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2025-71379

Affected Products

Vllm

References · 3

• https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71379 · Security Note
• https://vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-components · Note