CVE-2026-55574

[CVE catalog]

A flaw was found in vLLM, a high-throughput and memory-efficient inference and serving engine for large language models (LLMs). A remote attacker could exploit this vulnerability by providing a specially crafted regular expression to the structured_outputs.regex API parameter. This adversarial regex, containing nested quantifiers, can cause an exponential expansion of the state-space in the grammar compiler, leading to an inference worker hanging indefinitely. This results in a Denial of Service (DoS) for the affected system. vllm: vLLM: Denial of Service via adversarial regular expression in structured outputs API An Important denial of service vulnerability exists in vLLM, as utilized within Red Hat AI Inference Server and Red Hat OpenShift AI. This flaw allows a remote, unauthenticated attacker to cause an inference worker to hang indefinitely by submitting a specially crafted regular expression to the structured outputs API. The absence of complexity analysis for nested quantifiers in the regex compiler leads to an exponential state-space expansion, resulting in prolonged service disruption. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jul 1, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.58% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "vllm",
      "ecosystem": "cpe",
      "fixed_version": "0.24.0"
    },
    {
      "name": "vllm",
      "ecosystem": "pip",
      "fixed_version": "0.24.0"
    },
    {
      "name": "vllm",
      "ranges": [
        {
          "fixed": "0.24.0",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "0.24.0",
      "provider_record_id": "NVD-CVE-2026-55574"
    }
  ]
}