CVE-2025-48943
CVE-2025-48943 · vLLM allows clients to crash the openai server with invalid regex
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
CVSS 6.5 · Media · EPSS 0,5% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: python
Productos y versiones afectados
vllm
- Versiones
- >= 0.8.0, < 0.9.0: Afectada
Sin corrección publicada
vllm PyPI
- Versiones
- 0.8.0
- 0.8.1
- 0.8.2
- 0.8.3
- 0.8.4
- 0.8.5
- 0.8.5.post1
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 0.8.0, < 0.9.0
Actualiza a 0.9.0
vllm PyPI
- Versiones
- 0.8.0
- 0.8.1
- 0.8.2
- 0.8.3
- 0.8.4
- 0.8.5
- 0.8.5.post1
- Intervalos de versiones afectados
- GIT: < 08bf7840780980c7568c573c70a6a8db94fd45ff
- ECOSYSTEM: ≥ 0.8.0, < 0.9.0
Actualiza a 0.9.0
Fuentes originales
- https://github.com/vllm-project/vllm/security/advisories/GHSA-9hcf-v7m4-6m2j
- https://github.com/vllm-project/vllm/issues/17313
- https://github.com/vllm-project/vllm/pull/17623
- https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff
- https://nvd.nist.gov/vuln/detail/CVE-2025-48943