CVE-2025-48943: Vllm

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

Affected products

• Vllm Vllm: from 0.8.0, before 0.9.0 (fixed in 0.9.0)

Published 2025-05-30. Last modified 2026-06-17.