Cheng Kuan Yong Jason

2 exploits Active since May 2025
CVE-2025-48942 WRITEUP MEDIUM WRITEUP
vllm 0.8.0-0.9.0 - Denial of Service via Invalid JSON Schema in /v1/completions API
vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
CVSS 6.5
CVE-2025-48943 WRITEUP MEDIUM WRITEUP
vLLM 0.8.0-0.8.9 - Denial of Service via Invalid Regex in Structured Output
vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.
CVSS 6.5