Executive brief
vLLM is a high-throughput engine for serving large language models. A vulnerability in how it handles regular expressions for structured data generation allows an attacker to send a specially crafted request that causes the system to hang indefinitely. This results in a denial-of-service (DoS) condition, preventing the AI service from responding to legitimate users and potentially disrupting business operations.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in vLLM's xgrammar and outlines backends. The `structured_outputs.regex` API parameter passes user-supplied regex strings to compiler backends without a compilation timeout or sufficient complexity analysis. In the xgrammar backend, `compile_regex()` is called without guards. In the outlines backend, while `validate_regex_is_buildable()` checks for unsupported features like lookarounds, it fails to detect patterns with nested quantifiers (e.g., `(a+)+b`) that lead to exponential DFA state-space explosion. An unauthenticated remote attacker can exploit this by submitting a request with an adversarial regex, causing the inference worker to hang indefinitely. The issue is fixed in version 0.24.0 by implementing compilation deadlines and enhanced complexity checks.
Affected products
- vLLM Project vLLM < 0.24.0
Timeline
- 2026-07-02: disclosed: Initial disclosure by reporter
- 2026-07-06: other: Published to NVD
- 2026-07-17: advisory: GitHub Advisory published