CVE-2026-55574
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in the vLLM inference engine before version 0.24.0 allows an attacker to perform a DoS attack by sending a malicious regular expression to the structured_outputs.regex parameter. The expression, lacking compilation timeout and complexity analysis, causes state-space explosion in the grammar compiler, leading to inference worker hang.
Risk Assessment
An attacker can send a single request with a crafted regular expression, causing permanent hang of an inference worker and denial of service to other users. This can disrupt applications relying on vLLM.
Recommendation
Immediately upgrade vLLM to version 0.24.0 or later, which includes a fix for this vulnerability. Until the update, restrict access to the structured_outputs.regex parameter or implement additional regex validation mechanisms.
Original NVD description (English source)
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.