CyberRota Analysis
AI-GeneratedThe vulnerability affects the vLLM inference and serving engine for large language models, specifically in the handling of the structured_outputs.regex parameter, which can lead to excessive CPU consumption when processing unauthenticated requests. This can cause the structured-output engine to stall, potentially impacting the performance and availability of services relying on it. Organizations using versions prior to 0.26.0 should prioritize upgrading to mitigate the risk of denial-of-service conditions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0.