VulnerabilityAnalyzed
CVE-2025-48942
This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema.
MEDIUM 6.5EPSS 0.54%
Does this matter?
Lower severity and a low EPSS score (0.54%). Track it; it rarely justifies an emergency change on its own.
Description
vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.54% probability · 44th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-248
- Affected
- vllm/vllm
- Source
- security-advisories@github.com
References
- https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ffPatch
- https://github.com/vllm-project/vllm/issues/17248Issue Tracking
- https://github.com/vllm-project/vllm/pull/17623Issue Tracking, Patch
- https://github.com/vllm-project/vllm/security/advisories/GHSA-6qc9-v4r8-22xgExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.