CVE-2025-25183

vLLM hash collisions cause cache reuse, interfering with responses. Upgrade to v0.7.2.

• CVSS 2.6
• CWE-354
• Resource Management
• Remote

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting in cache reuse, which can interfere with subsequent responses and cause unintended behavior. Prefix caching makes use of Python's built-in hash() function. As of Python 3.12, the behavior of hash(None) has changed to be a predictable constant value. This makes it more feasible that someone could try exploit hash collisions. The impact of a collision would be using cache that was generated using different content. Given knowledge of prompts in use and predictable hashing behavior, someone could intentionally populate the cache using a prompt known to collide with another prompt in use. This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2025-25183

CWE

CWE-354

CVSS base score

2.6

Published

2025-02-07

OWASP

A04:2021 Injection

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Design Defects

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade to vLLM version 0.7.2 or later.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

# This is a conceptual example and might require adjustments
# depending on the specific vLLM implementation and Python version.
# It aims to generate hash collisions with prompts that include None.

def generate_colliding_prompt(target_prompt):
  """
  Generates a prompt designed to hash collide with the target_prompt, 
  especially when the target_prompt includes None or variations that hash to the same value as None in Python 3.12+.
  """
  # This is a placeholder and needs to be refined based on actual hash collisions.
  # The real payload depends on the exact implementation of the hashing in vLLM.

  prefix = "A" * 10  # Example filler
  collision_trigger = None #or some equivalent to None that has a predictable hash value
  suffix = "B" * 10  # Example filler

  colliding_prompt = f"{prefix}{collision_trigger}{suffix}"
  return colliding_prompt

# Example usage:
target_prompt = "Tra

@misc{vaitp:cve202525183,
  title        = {{vLLM hash collisions cause cache reuse, interfering with responses. Upgrade to v0.7.2.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-25183},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-25183/}}
}