CVE-2026-73556 vllm-project CVE debrief

Who should care

Roles responsible for managing and securing the vLLM infrastructure should assess exposure and apply the patch. This includes administrators, security teams, and developers working with the vLLM engine.

Why it matters

CVE-2026-73556 is a medium-severity vulnerability in the vLLM inference and serving engine for large language models. It allows unauthenticated requests to cause a denial-of-service (DoS) condition. Defenders should assess exposure, apply the patch, and monitor for suspicious requests. The vulnerability requires verification of patch application and validation of regex parameters.

• Denial-of-service (DoS) condition through CPU core consumption
• Potential system stall or crash
• Need for validation and compilation with timeout for regex parameters
• Verification of patch application and monitoring for suspicious requests

Technical summary

The vulnerability is caused by the structured_outputs.regex parameter being passed to lmformatenforcer.RegexParser without proper validation or compilation with a timeout. This allows an unauthenticated /v1/completions request to the lm-format-enforcer backend to cause a denial-of-service (DoS) by consuming a CPU core and stalling the structured-output engine path with a catastrophic regular expression.

Defensive priority

Defenders should prioritize assessing exposure and applying the patch, as the vulnerability can lead to a denial-of-service (DoS) condition. This requires immediate attention from roles responsible for managing and securing the vLLM infrastructure.

Recommended defensive actions

• Assess exposure by checking if the vLLM infrastructure is using a version prior to 0.26.0
• Apply the patch by upgrading to version 0.26.0 or later
• Monitor for suspicious /v1/completions requests to the lm-format-enforcer backend
• Verify the structured_outputs.regex parameter is properly validated and compiled with a timeout
• Perform asset inventory to identify potentially exposed systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vendor has released a patch in version 0.26.0 and provides additional information through their security advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.