GHSA-6qc9-v4r8-22xg: vLLM DOS: Remotely kill vllm over http with invalid JSON schema
6.5
Basic Information
PythonTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vllm | pip | >= 0.8.0, < 0.9.0 | 0.9.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability (GHSA-6qc9-v4r8-22xg) is a Denial of Service (DoS) in vLLM, triggered when the /v1/completions API endpoint receives a request with an invalid json_schema in the guided_json parameter. Specifically, a malformed schema, such as one containing {"type": "stsring"} (a typo for "string"), causes an unhandled RuntimeError within the xgrammar library, which vLLM uses for guided decoding.
The root cause is twofold:
- Insufficient Validation: The
vllm.v1.structured_output.backend_xgrammar.validate_xgrammar_grammarfunction, responsible for checking schema compatibility withxgrammar, did not, prior to the patch, robustly detect or handle all types of invalid schemas that could causexgrammarto crash. It allowed certain malformed schemas to be considered valid. - Unhandled Exception: When such a malformed schema subsequently reached the
vllm.v1.structured_output._async_create_grammarfunction, this function would callxgrammar.compiler.compile_json_schema. Thexgrammarlibrary, upon encountering the invalid schema, would raise aRuntimeError. This specific exception was not caught by_async_create_grammaror any of its callers within vLLM, leading to the termination of the vLLM engine process.
The provided patch (commit 08bf7840780980c7568c573c70a6a8db94fd45ff) addresses the vulnerability by strengthening the initial validation step in validate_xgrammar_grammar. It adds a try-except block that attempts to fully parse the schema using xgr.Grammar.from_json_schema(). If xgrammar raises any exception during this process, it is caught and re-raised as a ValueError. This ValueError is then properly handled by vllm.v1.engine.processor._validate_structured_output (the caller of validate_xgrammar_grammar), which can then decide to reject the request or fall back to an alternative decoding strategy, thus preventing the unhandled RuntimeError and the subsequent server crash.
Therefore, validate_xgrammar_grammar is identified as vulnerable due to its previous failure to prevent the problematic schema from advancing, and _async_create_grammar is identified as the function where the unhandled exception from the third-party library directly manifests, leading to the DoS. Both functions would appear in a runtime profile during the exploitation of this vulnerability.