Description (CNA)
vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vllm / vllm | affected 0.6.3 before 0.9.0; unaffected 0.9.0 |
CWE
CWE-1333
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp
- https://www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-components
ADP enrichment
No English description supplied.
No references supplied.