Executive brief
vLLM is an open-source large language model inference engine. The lm-format-enforcer backend, used to constrain generated output to match user-supplied regex patterns, fails to validate or time-limit regex compilation. An attacker can submit a catastrophic regex (such as `(a{1,300}){300}`) that causes the regex compiler to hang indefinitely, consuming a CPU core and blocking all concurrent structured-output requests on that worker.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in vLLM's lm-format-enforcer structured-output backend (vllm/v1/structured_output/backend_lm_format_enforcer.py, line 110). The backend calls `lmformatenforcer.RegexParser(grammar_spec)` directly on user-supplied regex strings without timeout or buildability checks. The underlying interegular FSM construction exhibits catastrophic complexity on exponential patterns like `(a{1,300}){300}`, which does not complete in 20+ seconds and pegs a CPU core at 100%. The sibling xgrammar and outlines backends were patched for the same issue (GHSA-rwxx-mrjm-wc2m) by wrapping regex compile in `compile_regex_with_timeout`, but lm-format-enforcer was overlooked. The attack is unauthenticated (vLLM has no auth by default) and requires only network access and selection of the lm-format-enforcer backend via `--structured-outputs-config` (not the default). Patched in version 0.26.0.
Affected products
- vLLM Project vLLM < 0.26.0
Timeline
- 2026-09-04: disclosed: GitHub Security Advisory published
- 2026-09-04: patched: Fix released in v0.26.0