SOURCE-LINKED INTELLIGENCE

GHSA-6qc9-v4r8-22xg: vLLM DOS: Remotely kill vllm over http with invalid JSON schema

OSV AI package advisories · observation · May 28, 2025 · UTC

### Summary Hitting the /v1/completions API with a invalid json_schema as a Guided Param will kill the vllm server ### Details The following API call `(venv) [derekh@ip-172-31-15-108 ]$ curl -s http://localhost:8000/v1/completions -H "Content-Type: application/json" -d '{"model": "meta-llama/Llama-3.2-3B-Instruct","prompt": "Name two great reasons to visit Sligo ", "max_tokens": 10, "temperature": 0.5, "guided_json":"{\"properties\":{\"reason\":{\"type\": \"stsring\"}}}"}' ` will provoke a Uncaught exceptions from xgrammer in `./lib64/python3.11/site-packages/xgrammar/compiler.py ` Issue with

Read original source ↗ Open in workspace

recordType

vulnerability

status

active

evidenceStatus

reported

region

Global