CVE-2025-71379: vllm - Regular Expression Denial of Service in Multiple Components
vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.9.0 - Compensating control
Reduce exposure to the susceptible vLLM regex-processing paths by rate-limiting and throttling requests to the OpenAI-compatible chat endpoint and the phi4mini tool parser until the vLLM upgrade to >= 0.9.0 is completed.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71379?
The severity of CVE-2025-71379 is medium, with a score of 4.3.
How do I fix CVE-2025-71379?
To fix CVE-2025-71379, update vLLM to a version greater than 0.9.0.
What components are affected by CVE-2025-71379?
CVE-2025-71379 affects multiple components including vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint.
What kind of vulnerability is CVE-2025-71379?
CVE-2025-71379 is a Regular Expression Denial of Service (ReDoS) vulnerability.
What versions of vLLM are impacted by CVE-2025-71379?
vLLM versions >= 0.6.3 and < 0.9.0 are impacted by CVE-2025-71379.