GHSA-9hcf-v7m4-6m2j CVE-2025-48943 PYSEC-2025-55

vLLM allows clients to crash the openai server with invalid regex

Medium PyPI

Severity: 6.5 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 0.51%; Chance of exploitation in the next 30 days. Higher than 43.39% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-248 Uncaught Exception
Fix: 0.9.0; Upgrade vllm to this version or later

Description

Impact

A denial of service bug caused the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg, but for regex instead of a JSON schema.

Issue with more details: https://github.com/vllm-project/vllm/issues/17313

Patches

https://github.com/vllm-project/vllm/pull/17623

Affected versions

PyPI

Package	Vulnerable	Fixed in
vllm	`>= 0.8.0, < 0.9.0`	`0.9.0`
vllm	`>= 0.8.0, < 0.9.0`	`0.9.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

vllm PyPI → `0.9.0`

pip

pip install --upgrade "vllm>=0.9.0"

poetry

poetry add "vllm>=0.9.0"

uv

uv add "vllm>=0.9.0"

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-248: Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2025-48943

Packages

github.com/vllm-project/vllm

Timeline

May 28, 2025 Published
Aug 7, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-8397-8qf6-f2gm vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine	Medium	Also affects vllm
GHSA-x567-49g5-p4cf vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs	Medium	Also affects vllm
GHSA-vvpg-rrww-wpmh vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server	Medium	Also affects vllm
GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)	Medium	Also affects vllm
GHSA-h3rc-j82p-2c3h vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE	High	Also affects vllm
GHSA-gq5q-89c7-vhvx vLLM DeepSeek-OCR image processing vulnerable to denial of service	Medium	Also affects vllm
GHSA-6757-hggm-hp2w vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled	High	Also affects vllm
GHSA-542m-9234-8gvf vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool	Medium	Also affects vllm

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor