CVE-2025-46722

Executive Summary

CVE-2025-46722 is a security and data integrity vulnerability in the vLLM inference engine, affecting versions 0.7.0 through 0.8.x. The flaw resides in the MultiModalHasher class within vllm/multimodal/hasher.py. The hashing method for PIL images uses only obj.tobytes(), which returns raw pixel data without including critical metadata such as image dimensions (width, height) and mode (e.g., RGB, L). This omission allows two images of different sizes but identical pixel byte sequences to produce the same hash value. This can lead to hash collisions, incorrect cache hits, and potential data leakage or security risks when the hash is used for caching or deduplication. The vulnerability has been patched in vLLM version 0.9.0.

Supply Chain & Package Security

This vulnerability affects the vLLM Python package, which is distributed via PyPI. Users of vLLM versions 0.7.0 to 0.8.x are at risk. The issue is not in a third-party dependency but in vLLM's own code. The fix is included in version 0.9.0, and users should upgrade immediately. There is no known public exploit code or PoC at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) - The vulnerability can be triggered remotely by sending crafted images to the vLLM service.
• Attack Complexity: Low (AC:L) - No special conditions are required; the attacker only needs to provide two images with identical pixel data but different dimensions.
• Privileges Required: None (PR:N) - No authentication is needed to exploit this.
• User Interaction: None (UI:N) - The victim does not need to perform any action beyond normal service operation.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) - Potential data leakage from incorrect cache hits.
• Integrity Impact: None (I:N) - No data modification.
• Availability Impact: None (A:N) - No denial of service.

Threat Level: Medium. While the CVSS score is relatively low, the potential for data leakage and cache poisoning in an LLM serving environment could have significant consequences, especially if the hash is used for sensitive data deduplication.

Deep Dive & Mechanics

The vulnerability is located in the MultiModalHasher class, specifically in the method that hashes PIL Image objects. The code uses obj.tobytes() to serialize the image. The tobytes() method returns the raw pixel data as a byte string, but it does not include the image's shape (width, height) or mode (e.g., RGB, grayscale). This means that two images with the same pixel data but different dimensions will produce identical byte strings.

For example:

• Image A: 30x100 pixels, RGB mode, all pixels red.
• Image B: 100x30 pixels, RGB mode, all pixels red.

Both images have the same total number of pixels (3000) and the same pixel data (all red). tobytes() will return the same byte sequence for both, leading to the same hash. This can cause:

• Hash Collisions: Different images map to the same hash.
• Incorrect Cache Hits: A cached result for one image may be incorrectly served for another image.
• Data Leakage: If the hash is used for deduplication or access control, an attacker could craft images to collide with sensitive images, potentially gaining access to cached data.

The fix in vLLM 0.9.0 includes the image's width, height, and mode in the hash calculation, ensuring that images of different dimensions produce different hashes.

Vulnerable vs. Patched Code

Vulnerable Code (vllm/multimodal/hasher.py, versions < 0.9.0):

class MultiModalHasher:
    def _hash_image(self, image: PIL.Image.Image) -> int:
        # Only uses raw pixel data, ignoring shape and mode
        return hash(image.tobytes())

Patched Code (vllm/multimodal/hasher.py, version 0.9.0):

class MultiModalHasher:
    def _hash_image(self, image: PIL.Image.Image) -> int:
        # Includes image metadata to prevent collisions
        return hash((image.tobytes(), image.size, image.mode))

The patched version creates a tuple containing the raw pixel data, the image size (width, height), and the mode, then hashes that tuple. This ensures that images with different dimensions or modes produce different hashes.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Exploit the hash collision to cause incorrect cache hits or data leakage.

Lab Setup:

1. Deploy a vulnerable vLLM instance (version 0.7.0 to 0.8.x) with multimodal support enabled.
2. Create two images with identical pixel data but different dimensions. For example:
   • Image A: 30x100 pixels, all red (RGB).
   • Image B: 100x30 pixels, all red (RGB).
3. Send Image A to the vLLM service, which will cache the result using the vulnerable hash.
4. Send Image B to the vLLM service. Due to the hash collision, the service may return the cached result from Image A, leading to incorrect output or data leakage.

Exploit Code (Python):

from PIL import Image
import numpy as np

# Create two images with identical pixel data but different dimensions
pixel_data = np.full((3000, 3), 255, dtype=np.uint8)  # 3000 red pixels

# Image A: 30x100
img_a = Image.fromarray(pixel_data.reshape(30, 100, 3), 'RGB')
# Image B: 100x30
img_b = Image.fromarray(pixel_data.reshape(100, 30, 3), 'RGB')

# Verify hash collision
from vllm.multimodal.hasher import MultiModalHasher
hasher = MultiModalHasher()
hash_a = hasher._hash_image(img_a)
hash_b = hasher._hash_image(img_b)
print(f"Hash A: {hash_a}, Hash B: {hash_b}, Collision: {hash_a == hash_b}")

Blue Team (Defender)

Detection:

1. Monitor for unusual cache hit patterns, especially for images with different dimensions.
2. Check vLLM logs for hash collision warnings (if any).
3. Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

1. Upgrade vLLM to version 0.9.0 or later.
2. If immediate upgrade is not possible, implement a workaround by overriding the _hash_image method to include image metadata.
3. Monitor for anomalous image requests that may indicate exploitation attempts.

Indicators of Compromise (IOCs)

• Hash Collision Events: Log entries showing different images producing the same hash.
• Anomalous Cache Hits: Unexpected cache hits for images with different dimensions.
• Network Traffic: Repeated requests for images with identical pixel data but different sizes.
• File Hashes: No specific file hashes, but the vulnerable code is in vllm/multimodal/hasher.py.

Detection Engineering

YARA Rule

rule CVE_2025_46722_vLLM_Hash_Collision {
    meta:
        description = "Detects vulnerable vLLM hasher code that omits image metadata"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-46722"
        severity = "medium"
    strings:
        $vuln_func = "def _hash_image" ascii
        $vuln_call = "image.tobytes()" ascii
        $vuln_return = "return hash(image.tobytes())" ascii
    condition:
        $vuln_func and $vuln_call and $vuln_return
}

Sigma Rule

title: CVE-2025-46722 - vLLM Hash Collision Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-46722 by monitoring for hash collisions in vLLM logs.
author: Valters IT
date: 2025-04-10
logsource:
    product: vllm
    service: multimodal
detection:
    selection:
        - "hash collision" or "duplicate hash" or "incorrect cache hit"
    condition: selection
falsepositives:
    - Legitimate hash collisions due to identical images (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46722 - vLLM Hash Collision Exploit Attempt"; flow:to_server; content:"image"; http_client_body; pcre:"/tobytes/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade vLLM: Update to version 0.9.0 or later, which includes the fix.
2. Workaround: If upgrade is not possible, override the _hash_image method in a custom subclass to include image metadata.

Long-Term Measures:

1. Code Review: Ensure all hashing functions include all relevant metadata.
2. Testing: Add unit tests to verify hash uniqueness for images with different dimensions.
3. Monitoring: Implement logging for hash collisions and anomalous cache behavior.

Patch Details:

• Fixed Version: vLLM 0.9.0
• Commit: The fix is included in the vLLM repository. Check the official GitHub release notes for the exact commit hash.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert