CVE-2025-71379

Name of the Vulnerable Software and Affected Versions vLLM versions 0.6.3 through 0.8.x

Description Multiple regular expression denial of service (ReDoS) issues exist where several regex patterns are susceptible to catastrophic backtracking—a condition where a complex regex takes an exponential amount of time to process certain inputs. This can be triggered by an attacker submitting crafted input with nested or repeated structures, leading to severe CPU consumption and performance degradation. The affected components include the OpenAI-compatible serving chat endpoint, the phi4mini tool parser, and the vllm/lora/utils.py file.

Recommendations Update to version 0.9.0 or later.