Threats tagged 'ghsa-48jh-3gj7-fg8v'

CVE-2026-73556 is a denial-of-service vulnerability in the vllm project's lm-format-enforcer backend. The backend compiles attacker-supplied regular expressions without a timeout or buildability check, allowing a crafted regex to stall the engine worker by consuming excessive CPU. This issue affects versions of vllm prior to 0.26.0 when the lm-format-enforcer backend is explicitly enabled. The default backend is not affected. The vulnerability results in unauthenticated denial of service by hanging the structured-output compile step and blocking concurrent requests.