CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2025-48943
Medium (6.5) in vllm vllm. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in vllm 0.9.0.
vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWE
- CWE-248
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vllm:vllm
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9hcf-v7m4-6m2j | PyPI | vllm | >=0.8.0 <0.9.0 | 0.9.0 |
| PYSEC-2025-55 | PyPI | vllm | >=0.8.0 <0.9.0 | 0.9.0 |