Executive brief
vLLM is a high-performance engine used to serve large language models (LLMs) to users and applications. A vulnerability in how it handles tool definitions allows an attacker to crash the backend service by sending a specially crafted request. This results in a denial-of-service, where the AI service becomes unavailable to all users until it is manually restarted.
Technical details
An improper input validation vulnerability (CWE-20) exists in the vLLM /v1/chat/completions endpoint. When the 'tools' functionality is invoked, the 'type' and 'pattern' fields are processed without sufficient validation. Specifically, the 'type' field is passed to a C++ JSON schema converter that throws a fatal RuntimeError for unsupported values, and the 'pattern' field is passed to a native C++ regex engine where malformed expressions (such as unclosed parentheses) cause the worker process to crash. An attacker with network access and minimal privileges can trigger this crash with a single POST request, leading to a persistent denial-of-service until the worker is restarted. The issue is addressed in version 0.9.0.
Affected products
- vLLM Project vllm >= 0.8.0, < 0.9.0
Timeline
- 2025-05-28: disclosed
- 2025-05-28: advisory
- 2025-05-28: patched: Fixed in version 0.9.0