vLLM EUVD-2026-58063

Exploitation requires that the target vLLM deployment uses the lm-format-enforcer backend for structured outputs (not the default xgrammar backend), and that the /v1/completions endpoint accepts requests with a structured_outputs.regex parameter from the attacker's network location. The CVSS vector (PR:N) confirms no authentication is required. The primary limiting factor is the backend requirement: operators running vLLM with the default xgrammar structured output backend, or those who have not enabled the lm-format-enforcer backend, are not affected by this code path. Additionally, operators who restrict /v1/completions to authenticated or trusted callers via an API gateway reduce exploitation feasibility even on unpatched versions.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L scores 5.3 (Medium), and the metrics are accurate: the endpoint is network-reachable with no authentication and no prerequisite complexity, while the actual impact is bounded to low availability - one CPU core consumed, one engine path stalled, rather than a full service crash. EPSS data was not supplied; given the absence of KEV listing and public exploit code, opportunistic mass exploitation is unlikely at time of analysis, though any developer or security researcher familiar with ReDoS can reproduce the condition trivially. The realistic threat model is targeted disruption of inference availability in AI serving infrastructure - particularly relevant to organizations that expose vLLM API endpoints to semi-trusted or external consumers, such as multi-tenant LLM platforms or internal developer portals without rate limiting. The low availability impact rating may understate operational consequence in latency-sensitive inference deployments where stalling the structured-output path degrades the entire request queue sharing that backend, though scope remains unchanged (S:U) and the impact does not escape the vLLM process boundary.

An attacker sends an unauthenticated HTTP POST to /v1/completions on a publicly reachable vLLM instance, setting structured_outputs.regex to a catastrophically backtracking pattern such as (a+)+ applied to a non-matching input string. The lm-format-enforcer backend passes this pattern directly to RegexParser without a timeout, triggering exponential NFA evaluation that pins one CPU core and causes the structured-output engine thread to stall, degrading or blocking all subsequent structured-output inference requests until the process is restarted.