CWE-248 vulnerabilities

vLLM is an inference and serving engine for large language models (LLMs). Version 0.8.0 up to but excluding 0.9.0 have a Denial of Service (ReDoS) that causes the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to GHSA-6qc9-v4r8-22xg/CVE-2025-48942, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

vLLM is an inference and serving engine for large language models (LLMs). In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid json_schema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex instead of a JSON schema. Version 0.9.0 fixes the issue.

CVE-2025-20054 is a denial of service vulnerability affecting some Intel processors. It arises from an uncaught exception in the core management mechanism, which may be triggered by an authenticated local user. The vulnerability does not require user interaction and has a medium severity rating based on CVSS 4.0 metrics.

CVE-2025-3891 is a denial of service vulnerability in the mod_auth_openidc module for Apache HTTP Server. When the OIDCPreservePost directive is enabled, an unauthenticated remote attacker can cause the server to crash by sending an empty POST request, resulting in a loss of availability. This issue affects version 2.0.0 of mod_auth_openidc. A security update addressing this vulnerability is available from Red Hat.

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.

Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state.2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customers update their devices to the latest 2N OS.

Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change.

CVE-2024-34363 is a high-severity vulnerability in Envoy proxy versions 1.28.0 through 1.28.3, 1.29.0 through 1.29.4, and 1.30.0 through 1.30.1. It arises from how Envoy uses the nlohmann JSON library, which can throw an uncaught exception when processing incomplete UTF-8 strings from downstream data. This uncaught exception causes Envoy to crash, resulting in a denial of service.