CVE-2026-55574 Details
Description
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.
A denial-of-service vulnerability exists in vLLM versions prior to 0.24.0. The issue arises in the structured_outputs.regex API parameter, which allows user-supplied regular expressions to be sent directly to grammar compiler backends without a compilation timeout. In the xgrammar backend, the regex is passed to the compiler without any safeguards. The outlines backend does block certain structural issues, such as lookarounds and backreferences, but fails to analyze regex complexity. This allows patterns with nested quantifiers to bypass checks and cause exponential state-space expansion, leading to an inference worker hanging indefinitely.
Users can update to vLLM version 0.24.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vllm-project/vllm/commit/2b3006076c5e9bc4cda9e03e3641388de3c5c286 | [email protected] | Patch |
| https://github.com/vllm-project/vllm/pull/45118 | [email protected] | Issue TrackingPatch |
| https://github.com/vllm-project/vllm/security/advisories/GHSA-rwxx-mrjm-wc2m | [email protected] | Vendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vllm vllm | < 0.24.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | New CVE Received | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |