EUVD-2026-41924
GHSA-rwxx-mrjm-wc2m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable unauthenticated API parameter (AV:N/PR:N/UI:N) with a low-effort crafted regex (AC:L) causing worker hang; impact is availability-only (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 4 pypi packages depend on vllm (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.24.0.
DescriptionCVE.org
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.
AnalysisAI
Denial of service in vLLM inference servers prior to 0.24.0 allows remote unauthenticated attackers to hang an inference worker indefinitely by submitting a single request with an adversarial regular expression via the structured_outputs.regex API parameter. The pattern is passed to grammar compiler backends (xgrammar with no guard, outlines with structural-but-not-complexity validation) where nested quantifiers trigger exponential state-space expansion (ReDoS). No public exploit identified at time of analysis, though the trivial request-based trigger makes weaponization straightforward.
Technical ContextAI
The vulnerability lives in vLLM's structured/guided decoding feature, which constrains LLM output to match a user-supplied grammar or regex. When a client sets structured_outputs.regex, the raw pattern is handed to one of two grammar compiler backends. In the xgrammar backend the string reaches the underlying regex compiler with no timeout or complexity guard. In the outlines backend, a validation step rejects structurally problematic constructs like lookarounds and backreferences but performs no algorithmic-complexity analysis, so a pattern using nested quantifiers (e.g. (a+)+) passes validation and then drives catastrophic backtracking / exponential automaton state expansion during compilation. This is the classic Regular Expression Denial of Service (ReDoS) root cause captured by CWE-1333 (Inefficient Regular Expression Complexity). The affected component is the vllm-project/vllm package (cpe:2.3:a:vllm-project:vllm), a widely used Python LLM serving engine.
RemediationAI
Vendor-released patch: upgrade vLLM to version 0.24.0 or later, which fixes the missing compilation guard/timeout on regex-based structured outputs (see advisory GHSA-rwxx-mrjm-wc2m at https://github.com/vllm-project/vllm/security/advisories/GHSA-rwxx-mrjm-wc2m and the fix in https://github.com/vllm-project/vllm/pull/45118 / commit 2b3006076c5e9bc4cda9e03e3641388de3c5c286). If you cannot upgrade immediately, disable or reject client-supplied structured_outputs.regex patterns at the API gateway or application layer (trade-off: breaks legitimate regex-constrained decoding); require authentication and restrict access to the inference endpoint so only trusted callers can submit regex parameters (trade-off: does not help against trusted-but-malicious or compromised clients); and place per-request CPU/time limits or a proxy timeout in front of the worker so a hung compilation is bounded and the worker can be recycled (trade-off: may prematurely cut off legitimate long-running requests). Prefer the outlines/xgrammar alternatives such as JSON-schema or choice-based guided decoding over free-form regex where feasible.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Vllm versions up to 0.12.0 is affected by allocation of resources without limits or throttling (CVSS 6.5).
Race condition in vLLM's prompt embedding loader allows concurrent API requests to bypass the sparse tensor invariant gu
Remote code execution in vLLM 0.10.1 through 0.13.x lets an attacker who controls the model repository or path run arbit
Server-Side Request Forgery in vLLM's multimodal MediaConnector allows remote attackers to coerce the inference server i
Denial of service in vllm 0.19.0's OpenAI-compatible serving path allows remote unauthenticated attackers to exhaust sch
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today