SOURCE-LINKED INTELLIGENCE
GHSA-vrq3-r879-7m65: vLLM Tool Schema allows DoS via Malformed pattern and type Fields
### Summary The vLLM backend used with the /v1/chat/completions OpenAPI endpoint fails to validate unexpected or malformed input in the "pattern" and "type" fields when the tools functionality is invoked. These inputs are not validated before being compiled or parsed, causing a crash of the inference worker with a single request. The worker will remain down until it is restarted. ### Details The "type" field is expected to be one of: "string", "number", "object", "boolean", "array", or "null". Supplying any other value will cause the worker to crash with the following error: RuntimeError: [11:
Read original source ↗ Open in workspace
- recordType
- vulnerability
- status
- active
- evidenceStatus
- reported
- region
- Global
Evidence & attribution
- OSV AI package advisories · 2025-05-28T19:42:32.000Z
- OSV AI package advisories · 2026-07-07T16:02:53.289Z
First collected: 2026-09-20T22:31:48.298Z. This is not the publication date.