CVE-2025-48942CWE-248

vLLM DOS: Remotely kill vllm over http with invalid JSON schema

Medium · published May 30, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2025-05-30T18:33Z
EPSS history
Timeline
  • 30 MAY 18:33Z
    vLLM DOS: Remotely kill vllm over http with invalid JSON schema
    cvelistv5