CVE-2026-73556

CVE-2026-73556 is catastrophic regex backtracking in vLLM's structured_outputs validation path. The vulnerability itself is straightforward: unbounded regex compilation on user-supplied patterns can hang the worker thread. But the context is what makes this worth your attention. The code already contained compile_regex_with_timeout — a defensive wrapper designed for exactly this scenario. It was not used on the /v1/completions structured_outputs path. That's the real failure. Either the validation path was added later without wiring the safety, or performance pressure led to deliberately skipping timeout enforcement on a throughput-critical code path. Either way, this is a security primitive that exists but isn't enforced by default — and that pattern almost certainly exists elsewhere in vLLM's request pipeline. What matters most in practice is the multi-tenant interference vector. When catastrophic backtracking hits a vLLM worker, it stalls that entire worker thread. In hosted environments — which is vLLM's primary deployment model — one malicious tenant's request degrades service for every concurrent tenant on that worker. This isn't self-DoS; it's tenant-to-tenant interference. The CVSS 5.3 rating reflects exploitability correctly but underweights this impact model. On the fix: version 0.26.0 applies compile_regex_with_timeout to this entry point. Verify whether that wrapper was designed with catastrophic backtracking specifically in mind, or whether it's a generic timeout that just restructures the DoS from 'indefinite hang' to 'predictable N-second stall per request.' If it's the latter, you've still got a scheduled denial-of-service — just a structured one. Also check whether other regex compilation points in the request pipeline remain unwired. Deployment-wise, many vLLM instances run behind authentication proxies. The unauthenticated /v1/completions surface shrinks significantly in those configs. But in multi-tenant hosted inference — where structured_outputs is a marketed feature — the exposure is direct. The window between structured_outputs adoption and patch deployment is the highest-risk period, because the feature is already in production use. Audit your deployment for other compile_regex_with_timeout calls that aren't enforced. Check whether your auth layer actually protects the structured_outputs endpoints. And treat this as a pattern-finding exercise: if security primitives exist but aren't automatic, look for what else was bypassed for throughput.

Reviewed through automated stages and approved by a human before publication.