CVE-2025-71379: vllm

Vulnerability summary

CVE-2025-71379 is a high (CVSS 7.5) vulnerability in vllm. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-06-2026
   PublishedVulnerability first disclosed.
2. 22-06-2026
   Last modifiedVulnerability information updated.

Description

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

• CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.