Description

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T15:20:17.927Z",
  "pubdate": "2026-08-13T15:20:17.927Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in the vLLM inference and serving engine prior to version 0.26.0. The flaw resides in the handling of the structured_outputs.regex parameter within the vllm/v1/structured_output/backend_lm_format_enforcer.py module. Unauthenticated attackers can supply specially crafted regular expressions via the /v1/completions endpoint against the lm-format-enforcer backend, bypassing validation and timeout constraints.\nSuccessful exploitation allows an adversary to consume a dedicated CPU core indefinitely and stall the structured-output engine path, leading to service degradation or complete denial of service for legitimate requests. The vulnerability requires network access to the API endpoints but does not require authentication or prior privileges. The risk is mitigated by updating the affected software to the patched version.",
  "technicalDetails": "The vulnerability is caused by insufficient input validation and the absence of safety controls when processing user-supplied regular expressions within the vLLM structured output subsystem. Specifically, the structured_outputs.regex parameter is directly passed to the lmformatenforcer.RegexParser function inside validate_structured_output_request_lm_format_enforcer without utilizing compile_regex_with_timeout or equivalent safety validations.\nAttack flow begins when an unauthenticated actor sends an HTTP request to the /v1/completions endpoint containing a maliciously crafted catastrophic backtracking regular expression (often associated with Regular Expression Denial of Service, or ReDoS). Because the input lacks proper regex complexity limits or execution timeout mechanisms, the underlying parsing engine processes the malformed pattern without constraints.\nWhen the lm-format-enforcer backend attempts to compile or evaluate the catastrophic regular expression, it triggers exponential backtracking. This monopolizes the processing thread and consumes an entire CPU core at 100 percent utilization. Consequently, the structured-output engine path becomes entirely unresponsive, stalling subsequent execution pipelines and preventing the processing of concurrent valid inference requests.\nThe vulnerable component is identified as the file vllm/v1/structured_output/backend_lm_format_enforcer.py within vLLM versions prior to 0.26.0. Exploitation requires network exposure of the API serving endpoints, but no authentication tokens, user interaction, or elevated privileges are required to trigger the parsing failure."
}