CVE-2026-55574

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.24.0

Description The structured outputs.regex API parameter allows user-supplied regular expression strings to be passed to grammar compiler backends without a compilation timeout or complexity analysis. In the xgrammar backend, the string is passed to the compile regex() function without guards. In the outlines backend, the validate regex is buildable() function blocks structural issues like lookarounds and backreferences but fails to detect nested quantifiers. This lack of validation can lead to exponential state-space expansion (regex/automata blowup), where a crafted adversarial regex can cause an inference worker to hang indefinitely, resulting in a denial of service.

Recommendations Update vLLM to version 0.24.0. As a temporary mitigation, restrict access to the structured outputs.regex API parameter to prevent the submission of untrusted regular expressions.