01 Record

CVE-2026-73556

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

MediumPUBLISHEDCNA: GitHub_M

Base score5.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

02 Description

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

Published: 2026-08-13 14:56Z1 DAY AGO
Last updated: 2026-08-14 16:52Z1 HR AGO
Reserved: 2026-08-12
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: Medium (CVSS 5.3)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-400 CWE-1333
SSVC decision: ExploitationpocAutomatableyesTechnical Impactpartial
Data version: 5.2
Document digest: 0ccfd3093aed64bdb358b698990cdbda4059ad7c9df221ba458c899cfa679aef

VendorProductVersionsPlatforms

vllm-projectvllm< 0.26.0—