CVE-2025-48887

A regular expression denial of service ReDoS flaw was found in vLLM. This vulnerability allows an attacker with prompt access to degrade or deny service in a vLLM instance. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

aana (>=0.2.1, <=0.2.2.2), hypogenic (>=0.0.1, <=0.1.1) potentially affected by CVE-2025-48887 via vllm (0.5.5)

vllm PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - aana =0.2.1, =0.0.1, =0.1.1 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

imitater (0.2.4), prometheus-eval (>=0.1.0, <=0.1.13) potentially affected by CVE-2025-48887 via vllm (0.4.3)

vllm PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - imitater 0.2.4 - prometheus-eval =0.1.0, =0.1.13 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

galadriel-node (>=0.0.8, <=0.0.16) potentially affected by CVE-2025-48887 via vllm (0.6.1)

vllm PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - galadriel-node =0.0.8, =0.0.16 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

decoding (0.1.1), lmcache-vllm (0.6.2.3) +2 more potentially affected by CVE-2025-48887 via vllm (0.6.2)

vllm PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - decoding 0.1.1 - lmcache-vllm 0.6.2.3 - oat-llm =0.0.1, =0.1.0, =0.1.1 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

contrastive-lm (0.1.0), decoding (>=0.1.2, <=0.1.4) +16 more potentially affected by CVE-2025-48887 via vllm (0.6.3.post1)

vllm PYPI version 0.6.3.post1 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - contrastive-lm 0.1.0 - decoding =0.1.2, =0.5.0, =0.2.2, =0.1.0, =3.1.0, =0.1.1, =0.8.1, =0.1.0.dev5, =0.1.0, =0.1.0, =0.1.0, =0.2.2 and more Sourc...

llmlite (>=0.0.13, <=0.0.15) potentially affected by CVE-2025-48887 via vllm (0.2.3)

vllm PYPI version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - llmlite =0.0.13, =0.0.15 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

imitater (>=0.1.2, <=0.1.4) potentially affected by CVE-2025-48887 via vllm (0.2.6)

vllm PYPI version 0.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - imitater =0.1.2, =0.1.4 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

llm-engines (>=0.0.1, <=0.0.2) potentially affected by CVE-2025-48887 via vllm (0.5.1)

vllm PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - llm-engines =0.0.1, =0.0.2 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

ares-ai (>=0.2.4, <=0.5.8) potentially affected by CVE-2025-48887 via vllm (0.4.1)

vllm PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - ares-ai =0.2.4, =0.5.8 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

aios-core (>=0.0.1b1, <=0.0.1b2), flute-kernel (>=0.2.6, <=0.4.1) +1 more potentially affected by CVE-2025-48887 via vllm (0.5.4)

vllm PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - aios-core =0.0.1b1, =0.2.6, =0.5.4.0, =0.5.4.1 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

arbor-ai (>=0.2.2, <=0.2.4), auralis (>=0.1.0, <=0.2.8.post2) +39 more potentially affected by CVE-2025-48887 via vllm (>=0.6.4.post1, <=0.8.5.post1)

vllm PYPI version =0.6.4.post1, =0.2.2, =0.1.0, =0.1.15rc1, =0.1.0a0, =0.0.2, =0.1.1, =0.1.10, =0.0.2, =0.0.17, =0.1.1, =0.2.0, =2.0.0a2, =2.0.0a3 and more Source cves: CVE-2025-48887 Source advisory: MEND:CVE-2025-48887...

arbor-ai (>=0.2.2, <=0.2.4), auralis (>=0.1.0, <=0.2.8.post2) +39 more potentially affected by CVE-2025-48887 via vllm (>=0.6.4.post1, <=0.8.5.post1)

vllm PYPI version =0.6.4.post1, =0.2.2, =0.1.0, =0.1.15rc1, =0.1.0a0, =0.0.2, =0.1.1, =0.1.10, =0.0.2, =0.0.17, =0.1.1, =0.2.0, =2.0.0a2, =2.0.0a3 and more Source cves: CVE-2025-48887 Source advisory: SNYK:PYTHON-VLLM-10260551...

arbor-ai (>=0.2.2, <=0.2.4), auralis (>=0.1.0, <=0.2.8.post2) +39 more potentially affected by CVE-2025-48887 via vllm (>=0.6.4.post1, <=0.8.5.post1)

vllm PYPI version =0.6.4.post1, =0.2.2, =0.1.0, =0.1.15rc1, =0.1.0a0, =0.0.2, =0.1.1, =0.1.10, =0.0.2, =0.0.17, =0.1.1, =0.2.0, =2.0.0a2, =2.0.0a3 and more Source cves: CVE-2025-48887 Source advisory: OSV:GHSA-W6Q7-J642-7C25...