-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability (GHSA-6qc9-v4r8-22xg) is a Denial of Service (DoS) in vLLM, triggered when the /v1/completions API endpoint receives a request with an invalid json_schema in the guided_json parameter. Specifically, a malformed schema, such as one containing {"type": "stsring"} (a typo for "string"), causes an unhandled RuntimeError within the xgrammar library, which vLLM uses for guided decoding.
The root cause is twofold:
vllm.v1.structured_output.backend_xgrammar.validate_xgrammar_grammar function, responsible for checking schema compatibility with xgrammar, did not, prior to the patch, robustly detect or handle all types of invalid schemas that could cause xgrammar to crash. It allowed certain malformed schemas to be considered valid.vllm.v1.structured_output._async_create_grammar function, this function would call xgrammar.compiler.compile_json_schema. The xgrammar library, upon encountering the invalid schema, would raise a RuntimeError. This specific exception was not caught by _async_create_grammar or any of its callers within vLLM, leading to the termination of the vLLM engine process.The provided patch (commit 08bf7840780980c7568c573c70a6a8db94fd45ff) addresses the vulnerability by strengthening the initial validation step in validate_xgrammar_grammar. It adds a try-except block that attempts to fully parse the schema using xgr.Grammar.from_json_schema(). If xgrammar raises any exception during this process, it is caught and re-raised as a ValueError. This ValueError is then properly handled by vllm.v1.engine.processor._validate_structured_output (the caller of validate_xgrammar_grammar), which can then decide to reject the request or fall back to an alternative decoding strategy, thus preventing the unhandled RuntimeError and the subsequent server crash.
Therefore, validate_xgrammar_grammar is identified as vulnerable due to its previous failure to prevent the problematic schema from advancing, and _async_create_grammar is identified as the function where the unhandled exception from the third-party library directly manifests, leading to the DoS. Both functions would appear in a runtime profile during the exploitation of this vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vllm | pip | >= 0.8.0, < 0.9.0 | 0.9.0 |
Ongoing coverage of React2Shell