Database/AI/ML frameworks & serving
vLLM: attacker-supplied structured-output regex pins a CPU core and stalls the engine path
Impact
The structured_outputs.regex parameter reaches lmformatenforcer.RegexParser without the compile timeout or the validation applied on other paths, so a single request carrying a catastrophically backtracking pattern occupies a CPU core and stalls the structured-output engine path. The GPU keeps its memory reservation and its allocation to that server while no useful work comes out of it, which on a GPU node is the expensive failure mode: the accelerator is neither serving nor free to reassign. One unauthenticated request is enough, and it can be repeated. Only deployments configured with the lm-format-enforcer structured-output backend are reachable; the advisory does not implicate the other backends.
Who can reach it
Anyone able to POST to /v1/completions on a server running the lm-format-enforcer backend. Unauthenticated where no API key is configured.
What to do
Upgrade to vLLM 0.26.0 and restart the affected servers. If an upgrade cannot happen now, switching the structured-output backend away from lm-format-enforcer removes the reachable path, or reject client-supplied regex at the gateway in front of the server.
References
Related entries
- vLLM: integer overflow in the activation CUDA kernel leaks another batched request's outputCVE-2026-73558 · vLLM CUDA activation kernels (act_and_mul_kernel, activation_kernels.cu)Medium
- vLLM (DeepStream video backend, VideoMediaIO backend selection): A performance feature merged past two existingNCVD-2026-044-vllm-deepstream-video-backend-vi · vLLM (DeepStream video backend, VideoMediaIO backend selection)Medium
- NVIDIA OpenShell for Linux: improper output encoding in the inference proxy leaks data and allows tamperingCVE-2026-65085 · NVIDIA OpenShell for Linux (inference proxy)Medium
- Pure Storage FlashArray key rotation logging (Rapid Data Locking): The Key Encryption Key is written to logs duringCVE-2025-2327 · Pure Storage FlashArray key rotation logging (Rapid Data Locking)Medium
- JupyterLab: stored XSS from javascript: URLs in extension metadata shown by Extension ManagerCVE-2026-67338 · JupyterLab Extension Manager (package metadata URL protocol validation)Medium
- TensorFlow Lite (flatbuffer models): Out-of-bounds via duplicate tensor indices in flatbuffer modelsCVE-2020-15211 · TensorFlow Lite (flatbuffer models)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.