Vulnerability in Vllm
CVE-2026-55574
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.
Vulnerability class: ReDoS (Regular Expression Denial of Service)
EPSS: 0.003 (25.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Vllm
- Vllm-project Vllm — versions < 0.24.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-55574?
- CVE-2026-55574 is a high-severity vulnerability in Vllm, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2026-07-06.
- How severe is CVE-2026-55574?
- High severity. CVSS v3 base score is 7.5 out of 10.