CVE-2025-71379

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jan 1, 2025, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.48% · Oct 25, 2026

A flaw was found in vLLM. Multiple regular expression denial of service (ReDoS) vulnerabilities exist in versions greater than or equal to 0.6.3 and less than 0.9.0. An attacker can exploit this by submitting crafted input with nested or repeated structures to specific regex patterns within vLLM, such as those in `vllm/lora/utils.py`, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint. This can lead to severe CPU consumption and performance degradation, resulting in a denial of service (DoS) for the affected system. vllm: vLLM: Denial of Service via regular expression denial of service (ReDoS) vulnerabilities Red Hat rates this issue as having Low impact for Red Hat AI products. Shipped vLLM versions in Red Hat OpenShift AI, Red Hat AI Inference Server, and Red Hat Enterprise Linux AI do not include the vulnerable regular expression code paths. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.