Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-13 | 2 | Disclosure1General1 |
| 2026-08-14 | 1 | Patch1 |
CVE-2026-73556 vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_for… https://www.cve.org/CVERecord?id=CVE-2026-73556
Post summary
The post references CVE-2026-73556 affecting vLLM before version 0.26.0 but lacks PoC, exploit details, active exploitation evidence, or specific remediation guidance.
New CVE-2026-73556 in https://vllm.ai. An earlier fix added a regex-compile timeout to 2 of 3 structured-output backends. The 3rd (lm-format-enforcer) was missed, one catastrophic regex pegs a CPU core and stalls the engine. Unauthenticated DoS. #CVE #Research https://t.co/fZMONcjfJJ
Post summary
A DoS vulnerability (CVE‑2026‑73556) in vllm.ai is caused by a catastrophic regex in the lm‑format‑enforcer backend; a prior patch covered two backends but not the third, revealing a missing workaround.
🚨*CVE* CVE-2026-73556 vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_for… https://www.cve.org/CVERecord?id=CVE-2026-73556 ----- Traducción: CVE-2026-73556 vLL… https://infoflow.cloud`
Post summary
The tweet announces CVE-2026-73556 for vLLM, pointing to a specific parameter in older versions that is vulnerable, but it lacks exploitation details, patch information, or a PoC.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vllm | vllm | - | - | - |