{"apiVersion":"1.0","identifier":"CVE-2026-73556","description":"vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.","publishedAt":"2026-08-13T15:20:17","lastModifiedAt":"2026-08-14T17:20:33","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73556","cvssScore":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","epssProbability":0.00315,"riskScore":0.55,"affectedProduct":"vLLM","affectedVersions":"<0.26.0","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73556","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73556","en":"https://www.redsauce.net/en/cves/CVE-2026-73556","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73556","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73556","de":"https://www.redsauce.net/de/cves/CVE-2026-73556","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73556","el":"https://www.redsauce.net/el/cves/CVE-2026-73556"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73556"}}