GHSA-hf3c-wxg2-49q9

Summary

vLLM vulnerable to Denial of Service by abusing xgrammar cache

Severity

medium

Published

2025-04-15

References

• https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3
• https://github.com/vllm-project/vllm/security/advisories/GHSA-hf3c-wxg2-49q9
• https://github.com/vllm-project/vllm/pull/16283

Related advisories

• CVE-2026-48746 — critical · PyPI/vllm
• CVE-2026-22778 — critical · PyPI/vllm
• CVE-2025-47277 — critical · PyPI/vllm
• CVE-2025-32444 — critical · PyPI/vllm
• GHSA-ggpf-24jw-3fcw — critical · PyPI/vllm
• CVE-2024-9052 — critical · PyPI/vllm
• CVE-2024-9053 — critical · PyPI/vllm
• CVE-2024-11041 — critical · PyPI/vllm

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity