Incomplete comparison with missing factors in vLLM - CVE-2025-46722

Detailed vulnerability description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to the MultiModalHasher  class in vllm/multimodal/hasher.py serializes PIL.Image.Image objects using only obj.tobytes(), which returns only the raw pixel data, without including metadata such as the imageâs shape (width, height, mode). As a result, two images of different sizes (e.g., 30x100 and 100x30) with the same pixel byte sequence could generate the same hash value. This may lead to hash collisions, incorrect cache hits, and even data leakage or security risks.

How to mitigate CVE-2025-46722

Sources

• https://github.com/vllm-project/vllm/security/advisories/GHSA-c65p-x677-fgj6