CVE-2025-46722 Overview
CVE-2025-46722 is a hash collision vulnerability in vLLM, an inference and serving engine for large language models (LLMs). The flaw resides in the MultiModalHasher class within vllm/multimodal/hasher.py. The class serializes PIL.Image.Image objects using only obj.tobytes(), which returns raw pixel data without metadata such as width, height, or mode. As a result, two images of different dimensions sharing the same pixel byte sequence can produce identical hash values. This collision can trigger incorrect cache hits, data leakage between unrelated requests, and potential security risks in multi-tenant inference deployments. The issue affects vLLM versions 0.7.0 through 0.9.0 (exclusive).
Critical Impact
Hash collisions in the multimodal cache can cause one user's cached image inference result to be returned to a different user request, enabling cross-tenant data leakage.
Affected Products
- vLLM versions 0.7.0 through 0.8.x
- vLLM deployments using multimodal (image) inputs
- LLM serving stacks integrating vLLM for vision-language models
Discovery Timeline
- 2025-05-29 - CVE-2025-46722 published to NVD
- 2025-06-24 - Last updated in NVD database
Technical Details for CVE-2025-46722
Vulnerability Analysis
The vulnerability stems from incomplete object serialization during multimodal cache key generation. vLLM caches multimodal preprocessing results to accelerate repeated inference. The cache lookup relies on a hash computed from the input image bytes. The original implementation invoked obj.tobytes() on PIL.Image.Image objects, returning a flat byte buffer of pixel values with no dimensional or mode context.
Two images with identical pixel byte sequences but different shapes, such as a 30×100 image and a 100×30 image, produce the same hash. When a collision occurs, the cache returns a result associated with a different input, potentially exposing prior tenants' processed image data or causing incorrect model behavior. The weakness is classified under [CWE-1023] (Incomplete Comparison with Missing Factors).
Root Cause
The item_to_bytes serialization path in MultiModalHasher omitted image metadata. Raw pixel bytes alone are insufficient to uniquely represent a PIL.Image.Image. Shape, channel mode (e.g., RGB vs. RGBA), and dtype must contribute to the hash input to guarantee collision resistance.
Attack Vector
An attacker submitting crafted images to a shared vLLM endpoint can engineer pixel data that collides with a target's cached entry. Because the endpoint is reachable over the network with no authentication required for the attack itself, exploitation is feasible against any multi-tenant inference service running a vulnerable version.
# Patch from vllm/multimodal/hasher.py - commit 99404f53c72965b41558aceb1bc2380875f5d848
return obj.encode("utf-8")
if isinstance(obj, bytes):
return obj
- if isinstance(obj, Image.Image):
- return obj.tobytes()
+ if isinstance(obj, (int, float)):
+ return np.array(obj).tobytes()
- # Convertible to NumPy arrays
+ if isinstance(obj, Image.Image):
+ return cls.item_to_bytes("image", np.array(obj.convert("RGBA")))
if isinstance(obj, torch.Tensor):
- obj = obj.numpy()
- if isinstance(obj, (int, float)):
- obj = np.array(obj)
+ return cls.item_to_bytes("tensor", obj.numpy())
if isinstance(obj, np.ndarray):
- return obj.tobytes()
+ return cls.item_to_bytes(
+ "ndarray", {
+ "dtype": obj.dtype.str,
+ "shape": obj.shape,
+ "data": obj.data.tobytes(),
+ })
Source: vLLM GitHub Commit 99404f5. The fix converts images to RGBA NumPy arrays and includes dtype and shape in the serialized representation, eliminating the collision class.
Detection Methods for CVE-2025-46722
Indicators of Compromise
- Unexpected or inconsistent model outputs for distinct image inputs submitted by different users or sessions.
- Cache hit metrics that diverge from expected request diversity in multimodal pipelines.
- vLLM server logs showing repeated identical hash keys across structurally different images.
Detection Strategies
- Audit the installed vLLM version with pip show vllm and flag any version >=0.7.0,<0.9.0.
- Inspect deployment manifests, container images, and requirements.txt files for vulnerable vLLM pins.
- Compare multimodal inference outputs against ground-truth references in a canary test set to detect cache poisoning.
Monitoring Recommendations
- Instrument vLLM with per-request hash logging and alert on duplicate hashes paired with differing image dimensions.
- Monitor outbound responses for content that does not correspond to the submitted image payload.
- Track software bill of materials (SBOM) data continuously to identify regressions to vulnerable vLLM versions.
How to Mitigate CVE-2025-46722
Immediate Actions Required
- Upgrade vLLM to version 0.9.0 or later, which contains the patched MultiModalHasher implementation.
- Invalidate and purge any existing multimodal cache entries generated by vulnerable versions.
- Restrict access to vLLM inference endpoints to authenticated, trusted clients while remediation is in progress.
Patch Information
The fix is delivered in vLLM 0.9.0 via Pull Request #17378 and commit 99404f53c72965b41558aceb1bc2380875f5d848. Full details are documented in the GitHub Security Advisory GHSA-c65p-x677-fgj6.
Workarounds
- Disable multimodal preprocessing caching where operationally acceptable until the upgrade is applied.
- Isolate inference workloads per tenant to prevent cache sharing across trust boundaries.
- Place a validating proxy in front of vLLM to reject image inputs that exceed expected dimensions or formats.
# Verify and upgrade vLLM to a patched release
pip show vllm | grep -i version
pip install --upgrade 'vllm>=0.9.0'
# Confirm the patched hasher is in place
python -c "import vllm, inspect; from vllm.multimodal import hasher; print(inspect.getsource(hasher.MultiModalHasher.item_to_bytes))"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
