Denial of Service Vulnerability in vLLM by the vLLM Project

CVE-2025-48956

What is CVE-2025-48956?

vLLM, an inference and serving engine for large language models, is exposed to a Denial of Service vulnerability due to insufficient handling of oversized HTTP headers. An attacker can exploit this risk by sending a single, specially crafted HTTP GET request containing an excessively large header. This vulnerability can cause server memory exhaustion, resulting in a crash or unavailability of the service. As the attack mechanism does not require user authentication, it poses a significant threat, making any remote user capable of triggering this failure. The issue has been addressed in the release version 0.10.1.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References