CVE-2025-25183: vLLM vulnerable to hash collisions in prefix cache

# CVE-2025-25183: vLLM vulnerable to hash collisions in prefix cache

https://gcdradar.vercel.app/incidents/cve-2025-25183-vllm-vulnerable-to-hash-collisions-in-prefix · AIR-2025-0197 · closed 2025-02-06

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-02-06
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2025-25183
- CVSS: 2.6

## Summary

An issue in vLLM allows maliciously constructed prompts to cause hash collisions in the prefix cache, leading to cache reuse and unintended behavior. Patches or mitigations are recommended for affected deployments.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-02-07: CVE-2025-25183: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. (https://nvd.nist.gov/vuln/detail/CVE-2025-25183)
- 2025-02-06: CVE-2025-25183: vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache (https://github.com/advisories/GHSA-rm76-4mrf-v9r8)

## Sources

- 2025-02-06 GitHub Advisory Database: CVE-2025-25183: vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache https://github.com/advisories/GHSA-rm76-4mrf-v9r8
- 2025-02-07 NVD: CVE-2025-25183: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. https://nvd.nist.gov/vuln/detail/CVE-2025-25183

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.