Skip to content
LLMMedium

CVE-2026-73556: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_o…

Occurred
Aug 13, 2026
Published
Aug 13, 2026
Source
NVD CVE

Summary

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.

Tags

  • CVE
  • CVE-2026-73556
  • cvss:MEDIUM

Classification

Category confidence: 90%
Severity confidence: 85%

Rationale: CVE describes a denial-of-service vulnerability in vLLM's structured output regex handling causing CPU stall.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source