EUVD-2026-41924
GHSA-rwxx-mrjm-wc2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed vLLM inference endpoint
-
DeliveryCraft request with nested-quantifier regex
-
ExploitSet structured_outputs.regex parameter
-
ExecutionGrammar backend compiles pattern unguarded
-
PersistExponential state expansion hangs worker
-
ImpactSustained inference denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target vLLM deployment (prior to 0.24.0) expose the structured/guided decoding API and permit client-supplied patterns via the structured_outputs.regex parameter, reachable by the attacker over the network without authentication (CVSS PR:N/UI:N). The specific trigger is an adversarial regex using nested quantifiers that passes the outlines backend's structural validation (which only blocks lookarounds and backreferences) or reaches the xgrammar backend, which has no guard at all. Limiting factors: the structured_outputs.regex feature must be enabled and accepting untrusted regex input - deployments that do not use guided decoding, restrict regex, or authenticate/whitelist callers are not practically exploitable; the impact is confined to availability (worker hang/DoS) with no code execution or data disclosure. |
| Impact | The provided CVSS 4.0 score of 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H reflects a purely availability-impacting flaw that is network-reachable, low-complexity, requires no privileges (PR:N, unauthenticated), and needs no user interaction - an accurate representation of a remotely triggerable ReDoS. There is no confidentiality or integrity impact (VC:N/VI:N), so this is strictly a denial-of-service issue, not RCE or data exposure despite the high headline number. No EPSS score, KEV listing, or POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Real-world priority is elevated for anyone exposing a vLLM OpenAI-compatible endpoint with structured/guided decoding enabled to untrusted clients, because a single crafted request can take down a worker with no auth; conversely, deployments that gate the API behind authentication, disable structured outputs, or restrict the regex feature face substantially lower practical risk. One caveat: the CVSS vector marks PR:N, but real exposure depends on whether the structured_outputs.regex path is reachable by untrusted users in a given deployment - verify endpoint exposure. |
| Exploit ScenarioDerived | An attacker with access to a vLLM OpenAI-compatible endpoint sends a single completion request that sets structured_outputs.regex to a pathological pattern with nested quantifiers (e.g. something like (a+)+$). The grammar compiler enters exponential state expansion and the inference worker hangs indefinitely, denying service to all other users; repeating the request against multiple workers can take down the whole serving fleet. No public POC is referenced, but the trigger is a plain API parameter requiring no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Denial of service in vLLM inference servers prior to 0.24.0 allows remote unauthenticated attackers to hang an inference worker indefinitely by submitting a single request with an adversarial regular expression via the structured_outputs.regex API parameter. The pattern is passed to grammar compiler backends (xgrammar with no guard, outlines with structural-but-not-complexity validation) where nested quantifiers trigger exponential state-space expansion (ReDoS). No public exploit identified at time of analysis, though the trivial request-based trigger makes weaponization straightforward.
RemediationAI
Vendor-released patch: upgrade vLLM to version 0.24.0 or later, which fixes the missing compilation guard/timeout on regex-based structured outputs (see advisory GHSA-rwxx-mrjm-wc2m at https://github.com/vllm-project/vllm/security/advisories/GHSA-rwxx-mrjm-wc2m and the fix in https://github.com/vllm-project/vllm/pull/45118 / commit 2b3006076c5e9bc4cda9e03e3641388de3c5c286). If you cannot upgrade immediately, disable or reject client-supplied structured_outputs.regex patterns at the API gateway or application layer (trade-off: breaks legitimate regex-constrained decoding); require authentication and restrict access to the inference endpoint so only trusted callers can submit regex parameters (trade-off: does not help against trusted-but-malicious or compromised clients); and place per-request CPU/time limits or a proxy timeout in front of the worker so a hung compilation is bounded and the worker can be recycled (trade-off: may prematurely cut off legitimate long-running requests). Prefer the outlines/xgrammar alternatives such as JSON-schema or choice-based guided decoding over free-form regex where feasible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in vLLM's structured/guided decoding feature, which constrains LLM output to match a user-supplied grammar or regex. When a client sets structured_outputs.regex, the raw pattern is handed to one of two grammar compiler backends. In the xgrammar backend the string reaches the underlying regex compiler with no timeout or complexity guard. In the outlines backend, a validation step rejects structurally problematic constructs like lookarounds and backreferences but performs no algorithmic-complexity analysis, so a pattern using nested quantifiers (e.g. (a+)+) passes validation and then drives catastrophic backtracking / exponential automaton state expansion during compilation. This is the classic Regular Expression Denial of Service (ReDoS) root cause captured by CWE-1333 (Inefficient Regular Expression Complexity). The affected component is the vllm-project/vllm package (cpe:2.3:a:vllm-project:vllm), a widely used Python LLM serving engine.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remotely reachable unauthenticated API parameter (AV:N/PR:N/UI:N) with a low-effort crafted regex (AC:L) causing worker hang; impact is availability-only (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.
Blast Radius
ecosystem impact- 4 pypi packages depend on vllm (4 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.24.0.
Executive ViewAI
vLLM inference servers in production are at risk of indefinite service disruption from a single unauthenticated request, with no mitigation available from the vendor at this time. Organizations deploying vLLM must immediately restrict access to the structured_outputs.regex feature to prevent attackers from disabling inference capabilities.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable the structured_outputs.regex feature if not operationally required; implement regex complexity analysis and validation before accepting patterns; apply rate limiting to restrict request frequency; use orchestration health checks (e.g., Kubernetes probes) to detect and restart hung workers; restrict inference endpoint access to trusted networks; monitor vendor communications for patch availability timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB