{"data":{"id":"064a6ec1-84d2-4986-b63f-15d024dedeb7","title":"CVE-2025-48956: vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of…","summary":"CVE-2025-48956 affects vLLM, an inference and serving engine for large language models, from 0.1.0 to before 0.10.1.1. A single HTTP GET request with an extremely large header, sent to an HTTP endpoint, triggers a Denial of Service that exhausts server memory and can crash the server or make it unresponsive. No authentication is required, so any remote user can exploit it.","solution":"Fixed in 0.10.1.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-48956","publishedAt":"2025-08-21T19:15:32.230Z","cveId":"CVE-2025-48956","cweIds":["CWE-400"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.1.0, < 0.10.1.1 (fixed: 0.10.1.1)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM denial of service through oversized HTTP GET request header","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00565,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":["GHSA-rxc4-3w6r-4v47"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:54.095Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-20T23:17:09.179Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:43:53.877Z","capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.10.1.1","matchedVersion":"0.10.1.1","fixReleasedAt":"2025-08-20T23:17:09.179Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:53.726Z"}]}}