CVE-2025-48956
High
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user. This vulnerability is fixed in 0.10.1.1.
SeverityHigh
CVSS7.5
Exploit probability—
ProductVllm
PublishedAug 21, 2025
First seenAug 21, 2025
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- vllm vllm0.10.1.1 or later
- vllm0.10.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vllm vllm | 0.1.0 ≤ v < 0.10.1.1 | 0.10.1.1 |
| vllmPyPI | 0.1.0 ≤ v < 0.10.1.1 | 0.10.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.