Performance Vulnerability in vLLM Multimodal Tokenizer Engine
CVE-2025-46560

7.5HIGH

Key Information:

Vendor

Vllm-project

Status
Vllm
Vendor
CVE Published:
30 April 2025

What is CVE-2025-46560?

The vulnerability in the vLLM multimodal tokenizer arises from inefficient input preprocessing in versions 0.8.0 to 0.8.4. The system's reliance on dynamic token replacement leads to poor performance characterized by quadratic time complexity (O(n²)). Such inefficiencies allow attackers to exploit the system through specially crafted inputs, triggering resource exhaustion and negatively impacting the server's performance. The issue has been resolved in version 0.8.5, emphasizing the importance of maintaining updated software to safeguard against such vulnerabilities.

Affected Version(s)

vllm >= 0.8.0, < 0.8.5

References

https://github.com/vllm-project/vllm/security/advisories/...
x_refsource_CONFIRM
https://github.com/vllm-project/vllm/blob/8cac35ba435906f...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2025-46560 : Performance Vulnerability in vLLM Multimodal Tokenizer Engine