CVE-2026-55574: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_ou

vLLM, a system that runs large language models efficiently, has a vulnerability in versions before 0.24.0 where users can submit malicious regular expressions (patterns used to match text) through the structured_outputs.regex parameter that cause the system to hang indefinitely, making it unavailable to other users. The vulnerability exists because the regex patterns are sent directly to backend compilers without checking if they will take too long to process, and patterns with nested quantifiers (like repeated matching operations inside each other) can cause exponential state-space expansion (the number of possible states the regex checker must evaluate grows exponentially). An attacker could exploit this to perform a denial-of-service attack (making a service unavailable to legitimate users).