Skip to content
LLMMedium

CVE-2025-48943: vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but ex…

Occurred
May 30, 2025
Published
May 30, 2025
Source
NVD CVE

Summary

vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

Tags

  • CVE
  • CVE-2025-48943
  • cvss:MEDIUM

Classification

Category confidence: 95%
Severity confidence: 90%

Rationale: vLLM is an LLM serving engine with a DoS vulnerability causing server crashes, fitting LLM category with medium severity due to technical failure without mass harm.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source