{"data":{"id":"242ae08a-d118-40fb-ab9b-b76547ad7f51","title":"CVE-2025-48887: vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service…","summary":"vLLM, an inference and serving engine for large language models (LLMs), contains a Regular Expression Denial of Service (ReDoS) flaw in `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` in versions 0.6.4 up to but excluding 0.9.0. The tool call detection regex uses multiple nested quantifiers, optional groups and inner repetitions, so an attacker can trigger catastrophic backtracking, severely degrading performance or making the service unavailable.","solution":"Version 0.9.0 contains a patch for the issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-48887","publishedAt":"2025-05-30T22:15:32.500Z","cveId":"CVE-2025-48887","cweIds":["CWE-1333"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.6.4, < 0.9.0 (fixed: 0.9.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM regular expression denial of service in pythonic tool parser","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00541,"epssCheckedAt":"2026-11-04T00:12:27.430Z","kevDateAdded":null,"advisoryAliases":["GHSA-w6q7-j642-7c25"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:41.338Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-05-28T01:30:28.547Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:44:25.916Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.9.0","matchedVersion":"0.9.0","fixReleasedAt":"2025-05-28T01:30:28.547Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:25.765Z"}]}}