CVE-2025-48887

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48887
vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` of versions 0.6.4 up to but excluding 0.9.0. The root cause is the use of a highly complex and nested regular expression for tool call detection, which can be exploited by an attacker to cause severe performance degradation or make the service unavailable. The pattern contains multiple nested quantifiers, optional groups, and inner repetitions which make it vulnerable to catastrophic backtracking. Version 0.9.0 contains a patch for the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/vllm-project/vllm/commit/4fc1bf813ad80172c1db31264beaef7d93fe0601 Patch
https://github.com/vllm-project/vllm/pull/18454 Issue Tracking Patch
https://github.com/vllm-project/vllm/security/advisories/GHSA-w6q7-j642-7c25 Exploit Vendor Advisory
https://github.com/vllm-project/vllm/security/advisories/GHSA-w6q7-j642-7c25 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
History

19 Jun 2025, 00:55

Type Values Removed Values Added
References () https://github.com/vllm-project/vllm/commit/4fc1bf813ad80172c1db31264beaef7d93fe0601 - () https://github.com/vllm-project/vllm/commit/4fc1bf813ad80172c1db31264beaef7d93fe0601 - Patch
References () https://github.com/vllm-project/vllm/pull/18454 - () https://github.com/vllm-project/vllm/pull/18454 - Issue Tracking, Patch
References () https://github.com/vllm-project/vllm/security/advisories/GHSA-w6q7-j642-7c25 - () https://github.com/vllm-project/vllm/security/advisories/GHSA-w6q7-j642-7c25 - Exploit, Vendor Advisory
First Time Vllm vllm
Vllm
Summary
  • (es) vLLM, un motor de inferencia y servicio para modelos de lenguaje grandes (LLM), presenta una vulnerabilidad de denegación de servicio por expresión regular (ReDoS) en el archivo `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` de las versiones 0.6.4 a 0.9.0, excepto esta última. La causa principal es el uso de una expresión regular anidada y altamente compleja para la detección de llamadas a herramientas, que un atacante puede explotar para causar una degradación grave del rendimiento o inhabilitar el servicio. El patrón contiene múltiples cuantificadores anidados, grupos opcionales y repeticiones internas, lo que lo hace vulnerable a un retroceso catastrófico. La versión 0.9.0 incluye un parche para este problema.
CPE cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*

30 May 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-30 18:15

Updated : 2025-06-19 00:55

NVD link : CVE-2025-48887

Mitre link : CVE-2025-48887

CVE.ORG link : CVE-2025-48887

JSON object : View

Products Affected

vllm

  • vllm
CWE
CWE-1333

Inefficient Regular Expression Complexity