CVE-2026-73556

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0

Description An unauthenticated request to the '/v1/completions' endpoint can cause a denial of service by consuming a CPU core and stalling the structured-output engine path. This occurs because the structured outputs.regex parameter in the vllm/v1/structured output/backend lm format enforcer.py file is passed to the lmformatenforcer.RegexParser within the validate structured output request lm format enforcer function without proper validation or a compilation timeout. This allows the use of a catastrophic regular expression, which is a pattern that causes extreme processing delays when matched against certain strings.

Recommendations Update to version 0.26.0. As a temporary mitigation, avoid using the structured outputs.regex parameter in the '/v1/completions' endpoint.