CVE-2025-71379

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

• CWE-1333

• https://github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhpExploit, Vendor Advisory
• https://www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-componentsThird Party Advisory

Published

Jun 20, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-71373picklescan before 0.0.33 fails to detect operator.methodcall…8.1
• CVE-2025-71374picklescan before 0.0.29 fails to detect the built-in python…8.1
• CVE-2025-71375picklescan before 0.0.34 fails to detect the _operator.metho…8.1
• CVE-2025-71376picklescan before 0.0.29 fails to detect malicious pickle fi…8.1
• CVE-2025-71377stoatchat (delta) versions before 20250210-1 (0.8.2) contain…8.7
• CVE-2025-71378picklescan before 0.0.30 fails to detect cProfile.runctx fun…7.8
• CVE-2025-7138A vulnerability was found in SourceCodester Best Salon Manag…8.8
• CVE-2025-71380The Execute Command node in n8n allows authenticated users t…8.8
• CVE-2025-71381Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its …6.9
• CVE-2025-71382MuPDF before 1.27.0-rc1 contains an uncontrolled recursion v…7.1
• CVE-2025-71385Netdata before 2.3.1 reflects the user-supplied love query p…6.1
• CVE-2025-71388stoatchat (delta/Revolt) versions from 20241213-1 before 202…7.6