4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46722

CVE-2025-46722: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary

In the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes(), which returns only the raw pixel data, without including metadata such as the image’s shape (width, height, mode). As a result, two images of different sizes (e.g., 30x100 and 100x30) with the same pixel byte sequence could generate the same hash value. This may lead to hash collisions, incorrect cache hits, and even data leakage or security risks.

Details

Affected file: vllm/multimodal/hasher.py
Affected method: MultiModalHasher.serialize_item https://github.com/vllm-project/vllm/blob/9420a1fc30af1a632bbc2c66eb8668f3af41f026/vllm/multimodal/hasher.py#L34-L35
Current behavior: For Image.Image instances, only obj.tobytes() is used for hashing.
Problem description: obj.tobytes() does not include the image’s width, height, or mode metadata.
Impact: Two images with the same pixel byte sequence but different sizes could be regarded as the same image by the cache and hashing system, which may result in:
- Incorrect cache hits, leading to abnormal responses
- Deliberate construction of images with different meanings but the same hash value

Recommendation

In the serialize_item method, serialization of Image.Image objects should include not only pixel data, but also all critical metadata—such as dimensions (size), color mode (mode), format, and especially the info dictionary. The info dictionary is particularly important in palette-based images (e.g., mode 'P'), where the palette itself is stored in . Ignoring can result in hash collisions between visually distinct images with the same pixel bytes but different palettes or metadata. This can lead to incorrect cache hits or even data leakage.

Miggo Vulnerability Database

→

CVE-2025-46722

CVE-2025-46722:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	>= 0.7.0, < 0.9.0	0.9.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the vllm.multimodal.hasher.MultiModalHasher class, specifically within its serialization logic used for hashing multimodal inputs. The root cause is the serialize_item method's insufficient serialization of PIL.Image.Image objects and numpy.ndarray objects.

For images, serialize_item previously called obj.tobytes(), which only extracts raw pixel data. It critically omitted metadata such as image dimensions (width, height), color mode, and other format-specific information (like palette data stored in Image.info). This meant that two visually distinct images (e.g., a 30x100 image and a 100x30 image, or two palette images with different palettes but same pixel indices) could produce the same byte stream if their raw pixel data happened to be identical in sequence.

Similarly, for numpy.ndarray objects (which could also originate from torch.Tensor or scalar inputs), serialize_item used obj.tobytes(), which serializes the array's data buffer but doesn't inherently include the array's shape or data type in a distinguishable way for the hasher. This could lead to arrays with the same total number of elements but different dimensions (e.g., a 2x6 array vs. a 3x4 array) producing the same byte stream if their flattened data was identical.

The hash_kwargs method uses serialize_item (indirectly in the vulnerable version through item_to_bytes) to convert all inputs into byte sequences before feeding them to a blake3 hashing function. Because serialize_item produced non-unique byte sequences for the distinct inputs described above, hash_kwargs would generate identical hash values for them. This hash collision is the primary impact, leading to incorrect cache hits (e.g., the system believing two different images are the same) and potential data leakage or incorrect application behavior.

The fix involved augmenting serialize_item to explicitly include all critical metadata (image dimensions, mode, RGBA conversion for consistency, numpy array shape, and dtype) as part of the byte stream fed to the hasher. This ensures that distinct inputs produce distinct byte sequences, thus preventing hash collisions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-46722: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary

Details

Recommendation

CVE-2025-46722:

4.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

4.2

4.2

Basic Information

Basic Information

CVE-2025-46722: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary

Details

Recommendation

Fixes

4.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-46722: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary

Details

Recommendation

CVE-2025-46722:

4.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

4.2

4.2

Basic Information

Basic Information

CVE-2025-46722: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary

Details

Recommendation

Fixes

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI