CVE-2025-46560
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Published Apr 30, 2025
Updated: May 2, 2025
CWE ID 1333
Summary
CVE-2025-46560 is a critical performance vulnerability affecting versions 0.8.0 to 0.8.4 of the vLLM inference and serving engine. The issue lies in the input preprocessing logic of the multimodal tokenizer, which inefficiently handles placeholder tokens using repeated tokens and list concatenation operations. This leads to a quadratic time complexity (O(n²)), enabling malicious inputs to cause resource exhaustion. Version 0.8.5 has been released to address this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- vLLM