CVE-2025-48956: vLLM API endpoints vulnerable to Denial of Service Attacks
Summary A Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user.
Details The vulnerability leverages the abuse of HTTP headers. By setting a header such as X-Forwarded-For to a very large value like ("A" 5800000000), the server's HTTP parser or application logic may attempt to load the entire request into memory, overwhelming system resources.
Impact What kind of vulnerability is it? Who is impacted? Type of vulnerability: Denial of Service (DoS)
Resolution Upgrade to a version of vLLM that includes appropriate HTTP limits by deafult, or use a proxy in front of vLLM which provides protection against this issue.
Other sources
vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user. This vulnerability is fixed in 0.10.1.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48956?
CVE-2025-48956 is classified as a Denial of Service (DoS) vulnerability that can lead to server memory exhaustion.
How do I fix CVE-2025-48956?
To mitigate CVE-2025-48956, update the affected vllm package to version 0.10.1.1 or later.
What type of attack exploits CVE-2025-48956?
CVE-2025-48956 can be exploited by sending a single HTTP GET request with an extremely large header.
What is the impact of CVE-2025-48956 on my server?
Exploiting CVE-2025-48956 can lead to memory exhaustion, causing the server to crash or become unresponsive.
Is authentication required to exploit CVE-2025-48956?
No, CVE-2025-48956 does not require authentication to exploit.