CVE-2026-73556: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex paramet

vLLM (a system for running and serving large language models) has a vulnerability in versions before 0.26.0 where the structured_outputs.regex parameter accepts user input without validation, allowing attackers to submit specially crafted regular expressions (patterns for matching text) that consume excessive CPU resources and freeze the system. An unauthenticated attacker can exploit this through the /v1/completions endpoint without needing a password or credentials.