SOURCE-LINKED INTELLIGENCE

GHSA-9hcf-v7m4-6m2j: vLLM allows clients to crash the openai server with invalid regex

OSV AI package advisories · observation · May 28, 2025 · UTC

### Impact A denial of service bug caused the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to [GHSA-6qc9-v4r8-22xg](https://github.com/vllm-project/vllm/security/advisories/GHSA-6qc9-v4r8-22xg), but for regex instead of a JSON schema. Issue with more details: https://github.com/vllm-project/vllm/issues/17313 ### Patches * https://github.com/vllm-project/vllm/pull/17623

Read original source ↗ Open in workspace

recordType: vulnerability
status: active
evidenceStatus: reported
region: Global

Evidence & attribution

OSV AI package advisories · 2025-05-28T19:42:12.000Z

First collected: 2026-09-20T22:31:48.298Z. This is not the publication date.