CVE-2025-48943mediumCWE-248

vLLM allows clients to crash the openai server with invalid regex

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%

probabilidad de explotación

0.4%top 66% de las CVE

explotación observada

noninguna fuente lo reporta

vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Productos afectados

vllm-project · vllm

Referencias

https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff https://github.com/vllm-project/vllm/issues/17313 https://github.com/vllm-project/vllm/pull/17623 https://github.com/vllm-project/vllm/security/advisories/GHSA-9hcf-v7m4-6m2j