Use of Weak Hash Affecting vllm package, versions [,0.7.2)


Severity

Recommended
0.0
low
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use of Weak Hash vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-PYTHON-VLLM-8689948
  • published7 Feb 2025
  • disclosed6 Feb 2025
  • creditkexinoh

Introduced: 6 Feb 2025

NewCVE-2025-25183  (opens in a new tab)
CWE-328  (opens in a new tab)

How to fix?

Upgrade vllm to version 0.7.2 or higher.

Overview

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Use of Weak Hash due to the use of a predictable constant value in the Python 3.12 built-in hash function. An attacker can interfere with subsequent responses and cause unintended behavior by exploiting predictable hash collisions to populate the cache with prompts known to collide with another prompt in use.

CVSS Scores

version 4.0
version 3.1