DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-73556: CVE-2026-73556: Regular Expression Denial of Service (ReDoS) in vLLM lm-format-enforcer Backend

#security #cve #cybersecurity

CVE-2026-73556: Regular Expression Denial of Service (ReDoS) in vLLM lm-format-enforcer Backend

Vulnerability ID: CVE-2026-73556
CVSS Score: 5.3
Published: 2026-09-04

CVE-2026-73556 is a Regular Expression Denial of Service (ReDoS) vulnerability in the vLLM inference engine's lm-format-enforcer structured-output backend. Prior to version 0.26.0, lack of compilation timeouts or complexity validation for user-supplied regular expressions in the structured_outputs.regex parameter allowed unauthenticated remote attackers to trigger CPU exhaustion and block the core execution loop.

TL;DR

Unauthenticated remote attackers can cause a complete Denial of Service (DoS) in vLLM by submitting a maliciously crafted regular expression that triggers exponential backtracking in the lm-format-enforcer backend, pinning the CPU at 100%.

Technical Details

  • CWE ID: CWE-1333 / CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.3 (Medium)
  • EPSS Score: 0.00315 (Percentile: 23.90%)
  • Impact: Denial of Service (CPU Exhaustion)
  • Exploit Status: No Public PoC Found
  • KEV Status: Not Listed

Affected Systems

  • vLLM
  • vllm: < 0.26.0 (Fixed in: 0.26.0)

Code Analysis

Commit: c9a788e

Wrap lm-format-enforcer regex parsing in timeout logic during validation and grammar compilation

Mitigation Strategies

  • Upgrade vLLM to version 0.26.0 or higher.
  • Restrict maximum regex pattern string lengths via external API gateway rules.
  • Implement WAF signature filtering to block nested quantifiers in JSON payloads.
  • Enforce network-level access control and authentication on vLLM endpoints.

Remediation Steps:

  1. Identify running vLLM containers and environments.
  2. Update the dependency manifest to vLLM >= 0.26.0.
  3. Deploy the updated application to production.
  4. Verify configuration settings to ensure the correct backend timeout behaves as expected.

References

Read the full report for CVE-2026-73556 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)