CVE-2025-48942: 
NixOS vulnerability analysis and mitigation

vLLM, an inference and serving engine for large language models (LLMs), contains a vulnerability in versions 0.8.0 up to but excluding 0.9.0. The vulnerability allows an attacker to crash the vLLM server by sending an invalid json_schema as a Guided Param to the /v1/completions API. This vulnerability was discovered in May 2025 and has been assigned CVE-2025-48942 with a CVSS v3.1 base score of 6.5 (MEDIUM) (GitHub Advisory, Wiz Database).

The vulnerability stems from uncaught exceptions from xgrammar in the compiler.py module. When the system receives an invalid json_schema, it assumes any validation error raised by xgrammar is due to unsupported json schema features, and the backend is reverted to guidance without further validation checks. This assumption leads to the server crash when processing invalid grammar specifications. The vulnerability has been assigned CWE-248 (Uncaught Exception) and affects the /v1/completions API endpoint (GitHub Advisory, Wiz Database).

When successfully exploited, this vulnerability results in a Denial of Service (DoS) condition, causing the vLLM server to crash. The impact is limited to availability, with no effect on the confidentiality or integrity of the system (Wiz Database).

The vulnerability can be exploited remotely by sending specially crafted requests to the /v1/completions API endpoint. The attack requires low complexity and minimal privileges, though it does require network access to the target system. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates that the attack can be performed over the network with low attack complexity (GitHub Advisory).

The vulnerability has been fixed in vLLM version 0.9.0. Users should upgrade to this version or later to prevent potential attacks. The fix includes additional guidance validation checks if the xgrammar validation fails, to catch invalid grammar specifications before attempting to compile the grammar (GitHub Advisory, Wiz Database).