CVE-2026-73556: vLLM ReDoS — MEDIUM

Q: Is CVE-2026-73556 actively exploited?

No confirmed active exploitation of CVE-2026-73556 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-73556?

1) Upgrade to vLLM 0.26.0 or later, which adds compile_regex_with_timeout/validation to the lm-format-enforcer request path. 2) Until patched, avoid exposing the lm-format-enforcer structured-output backend on internet-facing endpoints, or switch to the default outlines/xgrammar backend, which is not affected. 3) Add request-level rate limiting and regex-length/complexity caps at the API gateway in front of vLLM. 4) Monitor for CPU saturation or worker-thread stalls correlated with /v1/completions requests carrying structured_outputs.regex payloads — this is the detection signature for exploitation attempts.

Q: What systems are affected by CVE-2026-73556?

This vulnerability affects the following AI/ML architecture patterns: model serving, structured/constrained generation pipelines, multi-tenant inference endpoints.

Q: What is the CVSS score for CVE-2026-73556?

CVE-2026-73556 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.52%.

CISO Take

An unauthenticated attacker can send a single /v1/completions request carrying a malicious regular expression through the structured_outputs.regex parameter, and because vLLM's lm-format-enforcer backend never validates or bounds regex compilation time, that request pins a CPU core and stalls the structured-output engine path for every user sharing that inference server. This matters for any team running vLLM as a shared multi-tenant inference endpoint — one low-effort request degrades service for all downstream consumers of that node, which is a direct availability hit against production LLM serving infrastructure. The EPSS score (0.00315, top 76th percentile) is low and there's no KEV listing, public exploit, or Nuclei template yet, so this looks opportunistic rather than actively weaponized today, but the vulnerability class (catastrophic backtracking / ReDoS, CWE-400/CWE-1333) is trivial to reproduce once attackers notice the unauthenticated endpoint accepts arbitrary regex. Patch to vLLM 0.26.0, and until upgraded, restrict or rate-limit access to the lm-format-enforcer structured-output backend (or disable it in favor of the default outlines/xgrammar backend) on any internet-reachable deployment.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Medium severity (CVSS 5.3) reflecting a pure availability impact — no confidentiality or integrity loss. Attack complexity is low and no authentication or user interaction is required, which lowers the bar for exploitation to 'anyone who can reach the API'. The mitigating factor is that this only affects deployments explicitly configured to use the lm-format-enforcer structured-output backend (not the default), which narrows real-world exposure. EPSS remains low (0.3%) and CISA SSVC rates it TRACK_STAR (track, no urgent action), consistent with a DoS-only bug with no known exploitation.

How does the attack unfold?

Entry Point

Attacker sends an unauthenticated request to the public /v1/completions endpoint with a crafted structured_outputs.regex value.

AML.T0049

Exploitation

lm-format-enforcer compiles the regex without a timeout or validation, triggering catastrophic backtracking that pins a CPU core.

AML.T0034.001

Impact

The structured-output engine path stalls, degrading or denying service to all users of the shared inference server.

AML.T0029

Entry Point

Attacker sends an unauthenticated request to the public /v1/completions endpoint with a crafted structured_outputs.regex value.

AML.T0049

Exploitation

lm-format-enforcer compiles the regex without a timeout or validation, triggering catastrophic backtracking that pins a CPU core.

AML.T0034.001

Impact

The structured-output engine path stalls, degrading or denying service to all users of the shared inference server.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.26.0	`0.26.0`
92.7K 95 dependents Pushed 5d ago 26% patched ~47d to patch Full package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A Low

What should I do?

1 step

1) Upgrade to vLLM 0.26.0 or later, which adds compile_regex_with_timeout/validation to the lm-format-enforcer request path. 2) Until patched, avoid exposing the lm-format-enforcer structured-output backend on internet-facing endpoints, or switch to the default outlines/xgrammar backend, which is not affected. 3) Add request-level rate limiting and regex-length/complexity caps at the API gateway in front of vLLM. 4) Monitor for CPU saturation or worker-thread stalls correlated with /v1/completions requests carrying structured_outputs.regex payloads — this is the detection signature for exploitation attempts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Inference AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.4 - AI system operation and monitoring

NIST AI RMF

MAP-1 / MEASURE-2.3 - AI system availability and resilience

OWASP LLM Top 10

LLM04 - Model Denial of Service

Frequently Asked Questions

What is CVE-2026-73556?

An unauthenticated attacker can send a single /v1/completions request carrying a malicious regular expression through the structured_outputs.regex parameter, and because vLLM's lm-format-enforcer backend never validates or bounds regex compilation time, that request pins a CPU core and stalls the structured-output engine path for every user sharing that inference server. This matters for any team running vLLM as a shared multi-tenant inference endpoint — one low-effort request degrades service for all downstream consumers of that node, which is a direct availability hit against production LLM serving infrastructure. The EPSS score (0.00315, top 76th percentile) is low and there's no KEV listing, public exploit, or Nuclei template yet, so this looks opportunistic rather than actively weaponized today, but the vulnerability class (catastrophic backtracking / ReDoS, CWE-400/CWE-1333) is trivial to reproduce once attackers notice the unauthenticated endpoint accepts arbitrary regex. Patch to vLLM 0.26.0, and until upgraded, restrict or rate-limit access to the lm-format-enforcer structured-output backend (or disable it in favor of the default outlines/xgrammar backend) on any internet-reachable deployment.

Is CVE-2026-73556 actively exploited?

No confirmed active exploitation of CVE-2026-73556 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-73556?

1) Upgrade to vLLM 0.26.0 or later, which adds compile_regex_with_timeout/validation to the lm-format-enforcer request path. 2) Until patched, avoid exposing the lm-format-enforcer structured-output backend on internet-facing endpoints, or switch to the default outlines/xgrammar backend, which is not affected. 3) Add request-level rate limiting and regex-length/complexity caps at the API gateway in front of vLLM. 4) Monitor for CPU saturation or worker-thread stalls correlated with /v1/completions requests carrying structured_outputs.regex payloads — this is the detection signature for exploitation attempts.

What systems are affected by CVE-2026-73556?

This vulnerability affects the following AI/ML architecture patterns: model serving, structured/constrained generation pipelines, multi-tenant inference endpoints.

What is the CVSS score for CVE-2026-73556?

CVE-2026-73556 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

model servingstructured/constrained generation pipelinesmulti-tenant inference endpoints

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.4

NIST AI RMF: MAP-1 / MEASURE-2.3

OWASP LLM Top 10: LLM04

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.

Exploitation Scenario

An adversary discovers a publicly reachable vLLM inference endpoint (e.g., via Shodan or a known company API domain) running a version prior to 0.26.0 with the lm-format-enforcer backend enabled. Without needing any credentials, they submit a single /v1/completions request with a structured_outputs.regex value engineered for catastrophic backtracking (e.g., nested quantifiers like (a+)+$). The regex compilation pegs a CPU core and the structured-output engine path stalls, degrading response times or availability for all other tenants/users of that inference server — a low-cost, repeatable denial-of-service the attacker can trigger at will simply by re-sending the request.

Weaknesses (CWE)

CWE-1333 Inefficient Regular Expression Complexity Primary CWE-1333 Inefficient Regular Expression Complexity Primary CWE-400 Uncontrolled Resource Consumption Primary CWE-400 Uncontrolled Resource Consumption Primary CWE-1333 Inefficient Regular Expression Complexity CWE-400 Uncontrolled Resource Consumption

CWE-1333 — Inefficient Regular Expression Complexity: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

[Architecture and Design] Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
[System Configuration] Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Source: MITRE CWE corpus.