Advisory details:
pypa / vllm/PYSEC-2026-2022
| Advisory ID | pypa/vllm/PYSEC-2026-2022 |
| Aliases |
CVE-2025-46560
GHSA-vc6m-hm49-g9qg PYSEC-2026-2022 |
| Summary | phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service ### Summary A critical performance vulnerability has been identified in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., <|audio_*|>, <|image_*|>) with repeated tokens based on precomputed lengths. Due to inefficient list concatenation operations, the algorithm exhibits quadratic time complexity (O(n²)), allowing malicious actors to trigger resource exhaustion via specially crafted inputs. ### Details Affected Component: input_processor_for_phi4mm function. https://github.com/vllm-project/vllm/blob/8cac35ba435906fb7eb07e44fe1a8c26e8744f4e/vllm/model_executor/models/phi4mm.py#L1182-L1197 The code modifies the input_ids list in-place using input_ids = input_ids[:i] + tokens + input_ids[i+1:]. Each concatenation operation copies the entire list, leading to O(n) operations per replacement. For k placeholders expanding to m tokens, total time becomes O(kmn), approximating O(n²) in worst-case scenarios. ### PoC Test data demonstrates exponential time growth: ```python test_cases = [100, 200, 400, 800, 1600, 3200, 6400] run_times = [0.002, 0.007, 0.028, 0.136, 0.616, 2.707, 11.854] # seconds ``` Doubling input size increases runtime by ~4x (consistent with O(n²)). ### Impact Denial-of-Service (DoS): An attacker could submit inputs with many placeholders (e.g., 10,000 <|audio_1|> tokens), causing CPU/memory exhaustion. Example: 10,000 placeholders → ~100 million operations. ### Remediation Recommendations Precompute all placeholder positions and expansion lengths upfront. Replace dynamic list concatenation with a single preallocated array. ```python # Pseudocode for O(n) solution new_input_ids = [] for token in input_ids: if token is placeholder: new_input_ids.extend([token] * precomputed_length) else: new_input_ids.append(token) ``` |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.9 |
| Risk | 3.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.5 | https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-2022.yaml |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/vllm-project/vllm | ||
| https://github.com/vllm-project/vllm/blob/8cac35ba435906fb7eb07e44fe1a8c26e8744f4e/vllm/model_executor/models/phi4mm.py#L1182-L1197 | ||
| https://pypi.org/project/vllm | ||
| CVE-2025-46560 | https://nvd.nist.gov/vuln/detail/CVE-2025-46560 | |
| GHSA-vc6m-hm49-g9qg | https://github.com/advisories/GHSA-vc6m-hm49-g9qg | |
| GHSA-vc6m-hm49-g9qg | https://github.com/vllm-project/vllm/security/advisories/GHSA-vc6m-hm49-g9qg |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-30T13:09:10Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/46xxx/CVE-2025-46560.json
Source Advisory: vulnrichment/CVE-2025-46560
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]