vLLM Regular Expression Denial of Service vulnerability in pythonic_tool_parser.py
A Regular Expression Denial of Service vulnerability in vLLM's pythonic_tool_parser.py allows attackers to craft malicious payloads that cause exponential CPU consumption and GPU memory exhaustion, potentially rendering the service unavailable. The vulnerability affects versions 0.6.4 through 0.8.x and was fixed in version 0.9.0 by replacing the standard regex library with an alternative implementation.
What happened
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the file vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py in vLLM versions 0.6.4 through 0.8.x. The vulnerability stems from a highly complex and nested regular expression used for tool call detection that contains multiple nested quantifiers, optional groups, and inner repetitions, making it vulnerable to catastrophic backtracking.
An attacker can exploit this vulnerability by sending specially crafted payloads such as `[A(A= )A(A=, )A(A=, )A(A=, )...]` or `[A(A=` followed by repeated tab characters and patterns. A proof of concept demonstrates exponential time complexity: a 22-character input matches in 0.0000 seconds, a 102-character input takes 319.0717 seconds.
Reported impact
An attacker can trigger denial of service by sending specially crafted payloads to any API or interface that invokes this regex, causing excessive CPU usage and making the vLLM service unavailable. The matching process may hold significant CPU and memory resources for extended periods due to catastrophic backtracking.
In the context of vLLM, the associated KV cache used for model inference and typically stored in GPU memory is not released in a timely manner, leading to GPU memory exhaustion, degraded throughput, and service instability.
Index analysis
The vulnerability was discovered and reported through GitHub security advisories. A fix was implemented by replacing the standard re library with the regex library to prevent catastrophic backtracking, included in version 0.9.0 released on May 28, 2025.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.