{"data":{"id":"61d93112-e429-4bf1-ab08-26cf89d05af4","title":"CVE-2025-46722: vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before…","summary":"vLLM versions from 0.7.0 before 0.9.0 contain a flaw in the MultiModalHasher class in vllm/multimodal/hasher.py. Its image hashing method serializes PIL.Image.Image objects using only obj.tobytes(), which omits metadata such as width, height and mode, so images of different dimensions with identical pixel bytes can produce the same hash. This can cause hash collisions, incorrect cache hits, and possible data leakage.","solution":"Fixed in 0.9.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-46722","publishedAt":"2025-05-29T21:15:21.523Z","cveId":"CVE-2025-46722","cweIds":["CWE-1023","CWE-1288"],"cvssScore":"4.2","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.7.0, < 0.9.0 (fixed: 0.9.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM hash collisions in multimodal image hashing via raw pixel bytes","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00338,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-c65p-x677-fgj6"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:43.156Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-05-28T01:30:28.547Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:44:27.436Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.9.0","matchedVersion":"0.9.0","fixReleasedAt":"2025-05-28T01:30:28.547Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:27.283Z"}]}}