CVE-2026-55574
Last modified
CVE-2026-55574 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vllm | Vllm | < 0.24.0 |
References
- https://github.com/vllm-project/vllm/pull/45118Issue Tracking, Patch
- https://github.com/vllm-project/vllm/security/advisories/GHSA-rwxx-mrjm-wc2mVendor Advisory, Mitigation
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-55574?
How severe is CVE-2026-55574?
How do I fix CVE-2026-55574?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-55554Dompdf is an HTML to PDF converter for PHP. In versions 3.15…7.5
- CVE-2026-55555Dompdf is an HTML to PDF converter for PHP. Versions 3.15 an…7.5
- CVE-2026-5556A security vulnerability has been detected in badlogic pi-mo…6.3
- CVE-2026-55568Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in…5.9
- CVE-2026-5557A vulnerability was detected in badlogic pi-mono up to 0.58.…6.3
- CVE-2026-55570SiYuan is an open-source personal knowledge management syste…9
- CVE-2026-55575LiquidJS is a Shopify / GitHub Pages compatible template eng…8.2
- CVE-2026-55576MaaAssistantArknights is a one-click tool for daily Arknight…8.8
- CVE-2026-55577ImageMagick is free and open-source software used for editin…5.9
- CVE-2026-55578Pheditor is a single-file editor and file manager written in…8.8
- CVE-2026-55579Pheditor is a single-file editor and file manager written in…9.8
- CVE-2026-5558A flaw has been found in PHPGurukul PHPGurukul Online Shoppi…6.3
Are you affected by CVE-2026-55574?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST