CVE-2025-48956: vllm API endpoints vulnerable to Denial of Service Attacks
Summary A Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user. Details The vulnerability leverages the abuse of HTTP headers.
Published Aug 21, 2025 · Updated Jul 17, 2026
Affected packages
vllm
- Ecosystem
- PyPI
- Affected
- >= 0.1.0, < 0.10.1.1
- Fixed in
- 0.10.1.1
- Check
pip show vllm
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Summary
A Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user.
Details
The vulnerability leverages the abuse of HTTP headers. By setting a header such as X-Forwarded-For to a very large value like ("A" * 5_800_000_000), the server's HTTP parser or application logic may attempt to load the entire request into memory, overwhelming system resources.
Impact
_What kind of vulnerability is it? Who is impacted?_ Type of vulnerability: Denial of Service (DoS)
Resolution
Upgrade to a version of vLLM that includes appropriate HTTP limits by deafult, or use a proxy in front of vLLM which provides protection against this issue.
Credited to jperezdealgaba, russellb, taneem-ibrahim.
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-rxc4-3w6r-4v47
- https://github.com/vllm-project/vllm/pull/23267
- https://github.com/vllm-project/vllm/commit/d8b736f913a59117803d6701521d2e4861701944
- https://nvd.nist.gov/vuln/detail/CVE-2025-48956
- https://github.com/advisories/GHSA-rxc4-3w6r-4v47
- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2021.yaml
- https://github.com/vllm-project/vllm
- https://pypi.org/project/vllm
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More vLLM vulnerabilities
All vLLM entriesCVE-2026-105752
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
low3.1Oct 6, 2026CVE-2026-105753
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
medium6.5Oct 6, 2026CVE-2026-105754
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
medium6.5Oct 5, 2026CVE-2026-105755
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
medium4.2Oct 5, 2026CVE-2026-105756
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
medium6.5Oct 5, 2026CVE-2026-105757
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
medium6.5Oct 5, 2026