The vulnerability arises because the lm-format-enforcer backend in vllm compiles attacker-controlled regex patterns synchronously without applying a timeout or validating the regex's buildability. This contrasts with sibling backends (xgrammar and outlines) that use compile_regex_with_timeout to prevent catastrophic regex compilation. An attacker can submit a regex such as '(a{1,300}){300}' which causes the regex parser to consume 100% CPU core time indefinitely, resulting in a denial of service. The issue requires the operator to opt-in to the lm-format-enforcer backend via --structured-outputs-config. The vulnerability is tracked as CVE-2026-73556 with a CVSS 3.1 score of 5.3 (medium severity).

An unauthenticated attacker can cause a denial of service by submitting a specially crafted regex to the lm-format-enforcer backend, which will hang the regex compilation step and stall the engine worker. This leads to CPU exhaustion and blocks processing of concurrent requests, effectively causing a service outage. The impact is limited to deployments that have explicitly enabled the vulnerable backend; the default backend is not affected.

No official patch is currently confirmed. The suggested remediation is to apply the same compile_regex_with_timeout guard used in other backends to the lm-format-enforcer regex compilation and to add validation to reject un-buildable or oversized regex patterns. Operators should avoid enabling the lm-format-enforcer backend until a fix is released. Monitor the vendor advisory for updates on official fixes.