Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vllm | pip | < 0.26.0 | 0.26.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-73556, is a Regular Expression Denial of Service (ReDoS) in the lm-format-enforcer backend of vLLM. The core issue is that user-supplied regular expressions were compiled without a timeout or buildability check, allowing a crafted regex to consume excessive CPU resources and stall the engine worker. The provided patch addresses this by introducing compile_regex_with_timeout.
Two functions are identified as vulnerable:
backend_lm_format_enforcer.compile_grammar: This function was directly responsible for compiling the regex using lmformatenforcer.RegexParser(grammar_spec). The patch replaces this direct call with compile_regex_with_timeout, indicating that the original implementation lacked the necessary protection against catastrophic regexes.backend_lm_format_enforcer.validate_structured_output_request_lm_format_enforcer: This function, intended for validating structured output requests, previously lacked any validation for regex inputs. The patch adds a try-except block that uses compile_regex_with_timeout to pre-validate the regex, preventing malicious patterns from reaching the compilation stage. Its prior lack of validation made it a critical entry point for the ReDoS attack.When exploited, a crafted regex would first pass through validate_structured_output_request_lm_format_enforcer without being checked, then be processed by compile_grammar, where the lmformatenforcer.RegexParser call would hang, leading to a denial of service. Both functions are crucial to the exploitation path.
backend_lm_format_enforcer.compile_grammarvllm/v1/structured_output/backend_lm_format_enforcer.py
backend_lm_format_enforcer.validate_structured_output_request_lm_format_enforcervllm/v1/structured_output/backend_lm_format_enforcer.py