CVE-2025-71379

Executive Summary

CVE-2025-71379 identifies multiple Regular Expression Denial of Service (ReDoS) vulnerabilities in the vllm project, affecting versions 0.6.3 through 0.8.x. The flaws reside in three distinct components: the LoRA utility module (vllm/lora/utils.py), the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint. By submitting crafted input containing nested or repeated structures, an attacker can trigger catastrophic backtracking in the vulnerable regex patterns, leading to severe CPU consumption and service degradation. This is a network-based, low-complexity attack requiring no authentication, making it a significant availability threat for any exposed vllm instance.

Supply Chain & Package Security

vllm is a popular open-source Python package for large language model (LLM) inference and serving. The vulnerability exists in the core library, meaning any application or service that depends on vllm versions 0.6.3 to 0.8.x is potentially affected. Organizations using vllm in production should treat this as a high-priority supply chain risk, as the vulnerable code is executed during normal request processing. The package is distributed via PyPI, and the fix is available in version 0.9.0. Immediate upgrade is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Successful exploitation leads to denial of service.

Threat Level: High. The low attack complexity and lack of authentication requirements make this a significant threat for any publicly accessible vllm instance.

Deep Dive & Mechanics

The vulnerability is a classic ReDoS (Regular Expression Denial of Service) caused by catastrophic backtracking. The affected regex patterns contain nested quantifiers or overlapping alternations that, when matched against a carefully crafted input string, cause the regex engine to explore an exponential number of paths before failing.

Affected Components:

1. vllm/lora/utils.py: This module likely contains regex patterns used to parse or validate LoRA (Low-Rank Adaptation) configuration strings. A crafted input with deeply nested parentheses or repeated patterns can cause the regex engine to hang.

2. phi4mini Tool Parser: This parser handles tool/function call definitions for the phi4mini model. A maliciously crafted tool definition with nested structures can trigger the ReDoS.

3. OpenAI-Compatible Serving Chat Endpoint: This endpoint processes chat completion requests. The vulnerable regex is likely used to parse or sanitize user messages or system prompts. An attacker can send a request with a specially crafted message containing repeated or nested patterns to cause a denial of service.

Mechanism: The core issue is the use of regex patterns that allow for ambiguous matching. For example, a pattern like (a+)+b will cause catastrophic backtracking when given input like "aaaaac". The engine tries many ways to split the as between the inner and outer groups before failing.

Vulnerable vs. Patched Code

Since the exact vulnerable regex patterns are not publicly disclosed, we provide a generic example of a ReDoS vulnerability and its fix.

Vulnerable Code (Conceptual):

import re

# Vulnerable pattern: nested quantifiers
pattern = r'^(\w+)+$'
input_string = "a" * 30 + "!"  # 30 'a's followed by '!'

# This will cause catastrophic backtracking
if re.match(pattern, input_string):
    print("Match")
else:
    print("No match")

Patched Code (Conceptual):

import re

# Patched pattern: use atomic grouping or possessive quantifiers
pattern = r'^(?>\w+)+$'  # Atomic group prevents backtracking
# OR
pattern = r'^\w++$'  # Possessive quantifier

input_string = "a" * 30 + "!"

if re.match(pattern, input_string):
    print("Match")
else:
    print("No match")

Actual Fix: The vllm team likely replaced the vulnerable regex patterns with safer alternatives, such as using atomic groups, possessive quantifiers, or rewriting the logic to avoid nested quantifiers. The fix is included in vllm version 0.9.0.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target vllm instance running version 0.6.3 to 0.8.x.
• Network access to the OpenAI-compatible chat endpoint (e.g., /v1/chat/completions).

Exploit Steps:

1. Identify the Endpoint: Determine the base URL of the vllm instance (e.g., http://target:8000).

2. Craft the Payload: Create a malicious request that triggers the ReDoS. The exact payload depends on the vulnerable regex, but a general approach is to send a long string of repeated characters or nested structures.

   Example Payload (for chat endpoint):

   {
     "model": "default",
     "messages": [
       {"role": "user", "content": "A" + "a" * 10000 + "!"}
     ]
   }
   

   Example Payload (for LoRA endpoint):

   # Assuming the LoRA endpoint accepts a 'lora_name' parameter
   import requests
   url = "http://target:8000/v1/lora/load"
   payload = {"lora_name": "(" * 100 + "a" * 100 + ")" * 100}
   requests.post(url, json=payload)
   

3. Execute the Attack: Send the crafted request. The server will consume 100% CPU on one or more cores, potentially causing a denial of service for other requests.

Expected Outcome: The vllm server becomes unresponsive or extremely slow for the duration of the regex processing. Multiple concurrent requests can amplify the effect.

Blue Team (Defense & Detection)

Detection:

1. Monitor CPU Usage: Sudden spikes in CPU usage on the vllm server, especially when correlated with specific request patterns, are a strong indicator.

2. Analyze Request Logs: Look for requests with unusually long strings, repeated characters, or deeply nested structures in the content field of chat messages or in LoRA parameters.

3. Implement Rate Limiting: Apply strict rate limiting on the chat and LoRA endpoints to limit the impact of a single attacker.

Mitigation:

1. Upgrade vllm: The primary mitigation is to upgrade to vllm version 0.9.0 or later.

2. Web Application Firewall (WAF): Deploy a WAF with rules to block requests containing patterns indicative of ReDoS attacks (e.g., long strings of repeated characters).

3. Input Validation: Implement server-side input validation to reject requests with excessively long or complex strings before they reach the vulnerable regex.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /v1/chat/completions with content fields containing long strings of repeated characters (e.g., "aaaa...aaaa!").
  • HTTP POST requests to /v1/lora/load with lora_name parameters containing deeply nested parentheses.
  • High volume of requests from a single IP address targeting the vulnerable endpoints.

• System IOCs:

  • Sustained 100% CPU usage on the vllm server process.
  • Increased response times or timeouts for API requests.
  • Application logs showing regex-related errors or warnings (e.g., catastrophic backtracking).

• File IOCs:

  • No specific file-based IOCs are expected, as the attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2025_71379_ReDoS_vllm {
    meta:
        description = "Detects potential ReDoS payloads targeting vllm CVE-2025-71379"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-71379"
        severity = "high"
    strings:
        $repeated_chars = /([a-zA-Z0-9])\1{100,}/  // 100+ repeated characters
        $nested_parens = /\(.*\){50,}/  // 50+ nested parentheses
        $long_string = /.{1000,}/  // Strings longer than 1000 characters
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-71379 ReDoS Attempt Against vllm
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with patterns indicative of ReDoS attacks against vllm.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-71379
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/v1/chat/completions'
            - '/v1/lora/load'
    filter_repeated:
        cs-content|contains|all:
            - 'aaaa'
            - 'bbbb'
            - 'cccc'
    filter_nested:
        cs-content|contains|all:
            - '((('
            - ')))'
    condition: selection and (filter_repeated or filter_nested)
falsepositives:
    - Legitimate long prompts from users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-71379 vllm ReDoS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/v1/chat/completions"; http_uri; content:"aaaa"; http_client_body; within:1000; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade vllm: Upgrade to version 0.9.0 or later. This is the only definitive fix.

   pip install --upgrade vllm
   

2. Restrict Network Access: If immediate upgrade is not possible, restrict network access to the vllm API endpoints to trusted IP addresses only.

3. Implement Rate Limiting: Use a reverse proxy (e.g., Nginx, HAProxy) to apply strict rate limiting on the vulnerable endpoints.

Long-Term Mitigations:

1. Input Validation: Implement server-side input validation to reject requests with excessively long or complex strings before they reach the vulnerable regex.

2. Web Application Firewall (WAF): Deploy a WAF with rules to detect and block ReDoS patterns.

3. Monitoring: Continuously monitor CPU usage and request patterns for signs of exploitation.

4. Code Review: Conduct a security review of any custom regex patterns used in the application to ensure they are not vulnerable to ReDoS.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact your Valters IT representative.