Skip to content
LLMMedium

CVE-2025-48942: vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to bu…

Occurred
May 30, 2025
Published
May 30, 2025
Source
NVD CVE

Summary

vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

Tags

  • CVE
  • CVE-2025-48942
  • cvss:MEDIUM

Classification

Category confidence: 95%
Severity confidence: 90%

Rationale: vLLM LLM serving engine vulnerability causes server crash via invalid input, representing a notable failure without mass casualty or major financial loss.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source