The vulnerability in vLLM (CVE-2026-55574) involves inefficient regular expression complexity handling in the structured_outputs.regex API parameter. Before version 0.24.0, user-supplied regex strings are forwarded to the grammar compiler backends without a compilation timeout. The xgrammar backend applies no guard, and the outlines backend only blocks certain structural issues but does not analyze regex complexity. Consequently, adversarial regex patterns with nested quantifiers can cause exponential expansion in the regex engine's state space, resulting in a denial of service by indefinitely hanging inference workers. This vulnerability is addressed in vLLM version 0.24.0.

An attacker can supply a crafted regular expression that triggers exponential state-space expansion in the regex compiler, causing an inference worker to hang indefinitely. This results in a denial of service condition, impacting availability of the vLLM inference engine. The vulnerability requires no privileges or user interaction and can be exploited remotely via the structured_outputs.regex API parameter.

Upgrade vLLM to version 0.24.0 or later, where this vulnerability is fixed by adding appropriate compilation timeouts and complexity checks on user-supplied regular expressions. No other mitigation is documented. Patch status is confirmed fixed in 0.24.0.