Resource exhaustion in vLLM - CVE-2025-48956

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing HTTP header values. A remote attacker can send a specially crafted HTTP request with an overly large header value (e.g. for X-Forwarded-For header) to trigger resource exhaustion and perform a denial of service (DoS) attack.

Affected software

How to mitigate CVE-2025-48956

External References

• https://github.com/vllm-project/vllm/commit/d8b736f913a59117803d6701521d2e4861701944
• https://github.com/vllm-project/vllm/pull/23267
• https://github.com/vllm-project/vllm/security/advisories/GHSA-rxc4-3w6r-4v47

Related Security Bulletins

• Multiple vulnerabilities in vLLM