CVE-2025-71379

Description

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhp
• https://www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-components