CVE-2026-55574: vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
The structured_outputs.regex API parameter passes a user-supplied regex string directly to grammar compiler backends with no compilation timeout. In the xgrammar backend, the string reaches compile_regex() with no guard. In the outlines backend, validate_regex_is_buildable() blocks structural issues (lookarounds, backreferences) but provides zero protection against exponential DFA state-space explosion. Patterns like (a+)+b pass all checks and hang the inference worker.
References
- github.com/advisories/GHSA-rwxx-mrjm-wc2m
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2304.yaml
- github.com/vllm-project/vllm/commit/2b3006076c5e9bc4cda9e03e3641388de3c5c286
- github.com/vllm-project/vllm/pull/45118
- github.com/vllm-project/vllm/security/advisories/GHSA-rwxx-mrjm-wc2m
- nvd.nist.gov/vuln/detail/CVE-2026-55574
Code Behaviors & Features
Detect and mitigate CVE-2026-55574 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →