CVE-2025-48944

vLLM is an inference and serving engine for large language models (LLMs). In version 0.8.0 up to but excluding 0.9.0, the vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. The worker will remain down until it is restarted. Version 0.9.0 fixes the issue.

• CWE-20

• https://github.com/vllm-project/vllm/pull/17623Issue Tracking, Vendor Advisory
• https://github.com/vllm-project/vllm/security/advisories/GHSA-vrq3-r879-7m65Exploit, Vendor Advisory

Published

May 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48939tarteaucitron.js is a compliant and accessible cookie banner…4.2
• CVE-2025-4894A vulnerability classified as problematic was found in calmk…5.9
• CVE-2025-48940MyBB is free and open source forum software. Prior to versio…7.2
• CVE-2025-48941MyBB is free and open source forum software. Prior to versio…5.3
• CVE-2025-48942vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48943vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48945pycares is a Python module which provides an interface to c-…8.2
• CVE-2025-48946liboqs is a C-language cryptographic library that provides i…3.7
• CVE-2025-48947The Auth0 Next.js SDK is a library for implementing user aut…7.7
• CVE-2025-48948Navidrome is an open source web-based music collection serve…6.5
• CVE-2025-48949Navidrome is an open source web-based music collection serve…9.8
• CVE-2025-4895A vulnerability, which was classified as critical, has been …9.8