CVE-2025-46560

Deeper analysis

vLLM is a high-throughput inference and serving engine for large language models. Versions 0.8.0 through 0.8.4 contain a performance vulnerability in the multimodal tokenizer's input preprocessing logic. The affected code replaces placeholder tokens such as <|audio_|> and <|image_|> by repeatedly concatenating tokens according to precomputed lengths; the use of inefficient list operations produces quadratic time complexity, enabling an attacker to supply specially crafted inputs that trigger excessive CPU and memory consumption.

An authenticated remote attacker with low privileges can submit malicious multimodal prompts to the inference engine. Because the vulnerability affects only availability, successful exploitation results in resource exhaustion that can degrade or deny service to other users without disclosing data or altering model behavior.

The issue is resolved in vLLM 0.8.5. The project security advisory GHSA-vc6m-hm49-g9qg and the corresponding code change in phi4mm.py document the patch that replaces the quadratic concatenation pattern with an efficient implementation.

The vulnerability is specific to multimodal LLM workloads and carries a CVSS score of 6.5 with a high availability impact. EPSS remains low, with a recorded peak of 0.0152.