GHSA-85xf-c7hm-whqw: vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM versions 0.25.1 and earlier have a vulnerability where three different structured-output request paths (structured output is a feature that constrains an AI's responses to match a specific format) can trigger uncaught exceptions that crash the entire shared engine instead of failing just that one request, causing a denial of service (making the service unavailable) for all users on that engine. The root cause is missing error handling around grammar and token validation for structured output, allowing request-level errors to escape and kill the engine's core processing loop.