-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vllm | pip | >= 0.8.0, < 0.9.0 | 0.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2025-48942) is a denial-of-service (DoS) in vLLM caused by an uncaught RuntimeError from the xgrammar library when processing an invalid json_schema provided via the /v1/completions API. The xgrammar library's compile_json_schema function (specifically its C++ backend json_schema_converter.cc) fails with a RuntimeError: Check failed: (schema.is<picojson::object>()) is false: Schema should be an object or bool when given a malformed schema (e.g., {"properties":{"reason":{"type": "stsring"}}} where a property value is a string instead of an object).
In the vulnerable versions of vLLM:
vllm.v1.structured_output.backend_xgrammar.validate_xgrammar_grammar function, which is called to validate schemas for xgrammar, did not adequately detect this specific type of malformation. It primarily checked for unsupported features but didn't perform a trial compilation that would expose this RuntimeError.vllm.v1.structured_output.GrammarFactory._async_create_grammar. This function, as shown in the traceback, directly calls self.compiler.compile_json_schema(...) (where self.compiler is an xgrammar.compiler.Compiler instance).RuntimeError raised by xgrammar was not caught by _async_create_grammar or by upstream callers like vllm.v1.engine.processor.Processor._validate_structured_output (which had a try...except ValueError block, insufficient for this RuntimeError).The fix commit 08bf7840780980c7568c573c70a6a8db94fd45ff addresses this by modifying vllm.v1.structured_output.backend_xgrammar.validate_xgrammar_grammar to explicitly attempt to compile the JSON schema using xgr.Grammar.from_json_schema(schema). Any exception during this attempt is caught and re-raised as a ValueError. This ValueError is then correctly handled by vllm.v1.engine.processor.Processor._validate_structured_output, preventing the crash and allowing the system to gracefully reject the invalid schema, typically by returning a 400 Bad Request error to the client.
Therefore, vllm.v1.structured_output.GrammarFactory._async_create_grammar is vulnerable as it makes the direct call that leads to the unhandled exception. vllm.v1.structured_output.backend_xgrammar.validate_xgrammar_grammar is also identified as vulnerable (in its pre-patch state) because its insufficient validation allowed the problematic input to reach the crashing point.