PYSEC-2025-54: vLLM DOS: Remotely kill vllm over http with invalid JSON schema

Q: Which deployments are affected?

vLLM versions 0.8.0 through versions before 0.9.0 are affected. Version 0.9.0 fixes the issue.

Q: What access does an attacker need to trigger the denial of service?

An attacker needs network access to the vLLM /v1/completions API and the ability to submit a request using a Guided parameter containing an invalid JSON schema. The supplied vector indicates low attack complexity and low privileges required.

Q: What happens when the vulnerability is exploited?

A crafted request can kill the vLLM server, causing a denial of service. The provided impact information identifies availability impact, with no confidentiality or integrity impact.

Q: What should be done if upgrading cannot happen immediately?

Restrict access to the /v1/completions API to trusted callers that should be allowed to submit Guided parameters. This reduces exposure to untrusted requests containing invalid JSON schemas.

Published May 30, 2025

Updated

vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid jsonschema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

Affected Software

1 affected component

vllm vllm>=0.8.0<0.9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade vllm to a version that resolves this vulnerability.
Fixed in 0.9.0

Event History

May 30, 2025

CVE Published

via OSV·06:33 PM

Data Sourced

via OSV·06:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

vLLM versions 0.8.0 through versions before 0.9.0 are affected. Version 0.9.0 fixes the issue.

What access does an attacker need to trigger the denial of service?

An attacker needs network access to the vLLM /v1/completions API and the ability to submit a request using a Guided parameter containing an invalid JSON schema. The supplied vector indicates low attack complexity and low privileges required.

What happens when the vulnerability is exploited?

A crafted request can kill the vLLM server, causing a denial of service. The provided impact information identifies availability impact, with no confidentiality or integrity impact.

What should be done if upgrading cannot happen immediately?

Restrict access to the /v1/completions API to trusted callers that should be allowed to submit Guided parameters. This reduces exposure to untrusted requests containing invalid JSON schemas.

PYSEC-2025-54: vLLM DOS: Remotely kill vllm over http with invalid JSON schema

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to trigger the denial of service?

What happens when the vulnerability is exploited?

What should be done if upgrading cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to trigger the denial of service?

What happens when the vulnerability is exploited?

What should be done if upgrading cannot happen immediately?