Detections
Analytics

SCA: security update for vllm (GHSA-c65p-x677-fgj6)

high Tenable Cloud Security Plugin ID 427751

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0
 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data
 integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only
 obj.tobytes(), which returns only the raw pixel data, without including metadata such as the image’s shape
 (width, height, mode). As a result, two images of different sizes (e.g., 30x100 and 100x30) with the same
 pixel byte sequence could generate the same hash value. This may lead to hash collisions, incorrect cache
 hits, and even data leakage or security risks. This issue has been patched in version 0.9.0.
 (CVE-2025-46722)

See Also

https://github.com/advisories/GHSA-c65p-x677-fgj6

Plugin Details

Severity: High

ID: 427751

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 5/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.8

Percentile: 22.57

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2025-46722

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/28/2025

Vulnerability Publication Date: 5/28/2025

Reference Information

CVE: CVE-2025-46722