CVE-2025-48887

Summary

vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` of versions 0.6.4 up to but excluding 0.9.0. The root cause is the use of a highly compl

Severity

medium

EPSS

0.4% (p34)

Also known as

GHSA-w6q7-j642-7c25, PYSEC-2025-50

Published

2025-05-30

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-w6q7-j642-7c25
• https://github.com/vllm-project/vllm/security/advisories/GHSA-w6q7-j642-7c25
• https://github.com/vllm-project/vllm/commit/4fc1bf813ad80172c1db31264beaef7d93fe0601

Related advisories

• CVE-2026-48746 — critical · PyPI/vllm
• CVE-2026-22778 — critical · PyPI/vllm
• CVE-2025-47277 — critical · PyPI/vllm
• CVE-2025-32444 — critical · PyPI/vllm
• GHSA-ggpf-24jw-3fcw — critical · PyPI/vllm
• CVE-2024-9052 — critical · PyPI/vllm
• CVE-2024-9053 — critical · PyPI/vllm
• CVE-2024-11041 — critical · PyPI/vllm

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity