{"data":{"id":"140be3d5-1cec-40f6-bedc-6c1f38ab6819","title":"CVE-2025-25183: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed…","summary":"CVE-2025-25183 affects vLLM, a high-throughput inference and serving engine for LLMs. Maliciously constructed statements can cause hash collisions in prefix caching, which relies on Python's built-in hash() function, so cached content generated from different prompts can be reused and interfere with later responses. Because hash(None) became a predictable constant in Python 3.12, an attacker who knows the prompts in use could populate the cache with a colliding prompt.","solution":"Fixed in version 0.7.2; all users are advised to upgrade. There are no known workarounds for this vulnerability.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-25183","publishedAt":"2025-02-08T01:15:34.083Z","cveId":"CVE-2025-25183","cweIds":["CWE-354"],"cvssScore":"2.6","cvssSeverity":"low","severity":"low","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vllm@< 0.7.2 (fixed: 0.7.2)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM prefix caching hash collisions can reuse cache from other prompts","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00191,"epssCheckedAt":"2026-11-04T18:09:14.312Z","kevDateAdded":null,"advisoryAliases":["GHSA-rm76-4mrf-v9r8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:36.182Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-02-06T18:26:16.887Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:45:06.962Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.7.2","matchedVersion":"0.7.2","fixReleasedAt":"2025-02-06T18:26:16.887Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:06.805Z"}]}}