Regular Expression Denial of Service in vLLM by vLLM Project

CVE-2025-71379

What is CVE-2025-71379?

Certain versions of vLLM, specifically those ranging from 0.6.3 to 0.8.9, have been identified as susceptible to multiple regular expression denial of service vulnerabilities. Key components like vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint utilize regex patterns that are prone to catastrophic backtracking. An attacker can exploit these regex patterns by submitting specially crafted input featuring nested or repeated structures. This can lead to excessive CPU resource draining and significant performance degradation, rendering the affected system unable to provide service.

References