CVE-2025-48943mediumCWE-248

vLLM allows clients to crash the openai server with invalid regex

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%

probabilidade de exploração

0.4%top 66% das CVEs

exploração observada

nãonenhuma fonte reporta

vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Produtos afetados

vllm-project · vllm

Referências

https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff https://github.com/vllm-project/vllm/issues/17313 https://github.com/vllm-project/vllm/pull/17623 https://github.com/vllm-project/vllm/security/advisories/GHSA-9hcf-v7m4-6m2j