CVE-2026-73556Medium· 5.3▾ SunlitvLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
vllm < 0.26.0Patched in:
vllm 0.26.0Source: https://github.com/advisories/GHSA-48jh-3gj7-fg8v
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-71486Medium· 4.3vLLM is an inference and serving engine for large language models
CVE-2026-69147Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-73560Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-73555Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-73557MediumvLLM is an inference and serving engine for large language models