CVE-2025-48943
vLLM allows clients to crash the openai server with invalid regex
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
vLLM allows clients to crash the openai server with invalid regex
vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
Reserved 2025-05-28 | Published 2025-05-30 | Updated 2025-05-30 | Assigner GitHub_Mgithub.com/...t/vllm/security/advisories/GHSA-9hcf-v7m4-6m2j
github.com/vllm-project/vllm/issues/17313
github.com/vllm-project/vllm/pull/17623
github.com/...ommit/08bf7840780980c7568c573c70a6a8db94fd45ff
Support options
