CVE-2026-73556

Katalog CVE

CVSS 5.3 · Medium EPSS 0,52%

Kerentanan Uncontrolled Resource Consumption pada vllm. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-48jh-3gj7-fg8v advisory vendor
• https://github.com/vllm-project/vllm/commit/c9a788eedc412acceaa5112e0d44624b49841577 patch
• https://github.com/vllm-project/vllm/pull/47595 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 release notes