Publish Advisories

GHSA-p493-635q-r6gr
GHSA-6qc9-v4r8-22xg
GHSA-8r88-6cj9-9fh5
GHSA-9hcf-v7m4-6m2j
GHSA-cm76-qm8v-3j95
GHSA-vrq3-r879-7m65

advisories/github-reviewed/2021/03/GHSA-p493-635q-r6gr/GHSA-p493-635q-r6gr.json

@@ -109,7 +109,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-94"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,

advisories/github-reviewed/2025/05/GHSA-8r88-6cj9-9fh5/GHSA-8r88-6cj9-9fh5.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8r88-6cj9-9fh5",
-  "modified": "2025-05-27T18:00:17Z",
+  "modified": "2025-05-28T19:42:23Z",
   "published": "2025-05-27T18:00:17Z",
   "aliases": [
     "CVE-2025-48370"
@@ -40,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/supabase/auth-js/security/advisories/GHSA-8r88-6cj9-9fh5"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48370"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/supabase/auth-js/pull/1063"
@@ -60,6 +64,6 @@
     "severity": "LOW",
     "github_reviewed": true,
     "github_reviewed_at": "2025-05-27T18:00:17Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2025-05-27T16:15:32Z"
   }
 }

advisories/github-reviewed/2025/05/GHSA-9hcf-v7m4-6m2j/GHSA-9hcf-v7m4-6m2j.json

@@ -0,0 +1,67 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9hcf-v7m4-6m2j",
+  "modified": "2025-05-28T19:42:12Z",
+  "published": "2025-05-28T19:42:12Z",
+  "aliases": [],
+  "summary": "vLLM allows clients to crash the openai server with invalid regex",
+  "details": "### Impact\n\nA denial of service bug caused the vLLM server to crash if an invalid regex was provided while using structured output. This vulnerability is similar to [GHSA-6qc9-v4r8-22xg](https://github.com/vllm-project/vllm/security/advisories/GHSA-6qc9-v4r8-22xg), but for regex instead of a JSON schema.\n\nIssue with more details: https://github.com/vllm-project/vllm/issues/17313\n\n### Patches\n\n* https://github.com/vllm-project/vllm/pull/17623",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "vllm"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.8.0"
+            },
+            {
+              "fixed": "0.9.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-9hcf-v7m4-6m2j"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/vllm-project/vllm/issues/17313"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/vllm-project/vllm/pull/17623"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/vllm-project/vllm/commit/08bf7840780980c7568c573c70a6a8db94fd45ff"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/vllm-project/vllm"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-248"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-28T19:42:12Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/05/GHSA-cm76-qm8v-3j95/GHSA-cm76-qm8v-3j95.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cm76-qm8v-3j95",
-  "modified": "2025-05-21T16:53:09Z",
+  "modified": "2025-05-28T19:44:10Z",
   "published": "2025-05-21T16:53:09Z",
   "aliases": [
     "CVE-2025-47290"
@@ -32,9 +32,6 @@
             }
           ]
         }
-      ],
-      "versions": [
-        "2.1.0"
       ]
     }
   ],