CVE-2025-46722: vLLM MultiModalHasher Image Hashing Weakness

# CVE-2025-46722: vLLM MultiModalHasher Image Hashing Weakness

https://gcdradar.vercel.app/incidents/cve-2025-46722-vllm-multimodalhasher-image-hashing-weakness · AIR-2025-0288 · closed 2025-05-28

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-05-28
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2025-46722
- CVSS: 4.2

## Summary

An image hashing weakness in vLLM allows image hash collisions due to missing dimensions in the serialized byte sequence. This can lead to incorrect cache hits and potential data integrity issues.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-05-29: CVE-2025-46722: vLLM is an inference and serving engine for large language models (LLMs). (https://nvd.nist.gov/vuln/detail/CVE-2025-46722)
- 2025-05-28: CVE-2025-46722: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation (https://github.com/advisories/GHSA-c65p-x677-fgj6)

## Sources

- 2025-05-28 GitHub Advisory Database: CVE-2025-46722: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation https://github.com/advisories/GHSA-c65p-x677-fgj6
- 2025-05-29 NVD: CVE-2025-46722: vLLM is an inference and serving engine for large language models (LLMs). https://nvd.nist.gov/vuln/detail/CVE-2025-46722

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.