Denial of Service Vulnerability in vLLM Serving Engine by vLLM Project

CVE-2026-73556

What is CVE-2026-73556?

The vLLM serving engine for large language models is susceptible to a denial of service condition due to improper handling of the structured_outputs.regex parameter. An unauthenticated attacker can exploit this flaw by sending specially crafted requests to the lm-format-enforcer backend, which may lead to excessive CPU resource consumption, effectively stalling the structured output processing. The problem resides in the fact that, prior to version 0.26.0, the regex input was not subjected to adequate validation and timeout settings. This vulnerability can severely disrupt service availability, but it has been addressed in the latest release, version 0.26.0.

References