CVE-2026-73556

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Aug 13, 2026, 2:56:52 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in vLLM, an inference and serving engine for large language models. An unauthenticated remote attacker can exploit a Regular Expression Denial of Service (ReDoS) vulnerability in the lm-format-enforcer backend. By submitting a specially crafted regular expression through the structured_outputs.regex parameter, the attacker can cause the system to consume excessive CPU resources. This leads to a denial of service, stalling the structured-output engine and preventing legitimate requests from being processed. vllm: vLLM: Denial of Service via Regular Expression processing This flaw in vLLM is rated as Important because an unauthenticated remote attacker can trigger a Regular Expression Denial of Service (ReDoS). By sending a specially crafted regular expression to the `/v1/completions` endpoint, the attacker can cause the vLLM service to consume excessive CPU resources, leading to a complete stall of the structured-output engine and preventing legitimate requests. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.