CVE-2025-48942

Katalog CVE

CVSS 6.5 · Medium EPSS 0,55%

Kerentanan Uncaught Exception pada vllm. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

Rincian

Terbit di NVD

30 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-248: Uncaught Exception

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-6qc9-v4r8-22xg exploit · advisory vendor
• https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff patch
• https://github.com/vllm-project/vllm/pull/17623 issue tracking · patch
• https://github.com/vllm-project/vllm/issues/17248 issue tracking