CVE-2025-48942

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48942
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48942.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48942
Aliases
Published
2025-05-30T18:33:40Z
Modified
2026-10-21T02:30:46Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
Details

vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-248"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48942.json"
}
References

Affected packages

Git / github.com/vllm-project/vllm

Affected ranges

Type
GIT
Repo
https://github.com/vllm-project/vllm
Events
Introduced
966f933ee1cd7c9a41db60de5c7ff98657005251
Fixed
58738772410c5e0d60b61db39538a9b313d2d7ad
Fixed
08bf7840780980c7568c573c70a6a8db94fd45ff
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.8.0"
                },
                {
                    "fixed":  "0.9.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "08bf7840780980c7568c573c70a6a8db94fd45ff"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48942.json"