CVE-2025-29770: vLLM denial of service via outlines unbounded cache on disk
(updated )
The outlines library is one of the backends used by vLLM to support structured output (a.k.a. guided decoding). Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has been on by default in vLLM. Outlines is also available by default through the OpenAI compatible API server.
References
- github.com/advisories/GHSA-mgrm-fgjv-mhv8
- github.com/vllm-project/vllm
- github.com/vllm-project/vllm/blob/53be4a863486d02bd96a59c674bbec23eec508f6/vllm/model_executor/guided_decoding/outlines_logits_processors.py
- github.com/vllm-project/vllm/pull/14837
- github.com/vllm-project/vllm/security/advisories/GHSA-mgrm-fgjv-mhv8
- nvd.nist.gov/vuln/detail/CVE-2025-29770
Code Behaviors & Features
Detect and mitigate CVE-2025-29770 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →