THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-48jh-3gj7-fg8v (medium) — vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

[GHSA] GHSA-48jh-3gj7-fg8v (medium) — vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

medgithub_advisoriesPublished 2026-09-04

GHSA-48jh-3gj7-fg8v Severity: medium CVE: CVE-2026-73556

vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

### Summary

The fix for `GHSA-rwxx-mrjm-wc2m` ("ReDoS via `structured_outputs.regex` compiled without timeout") wrapped the regex compile in the **xgrammar** and **outlines** backends with `compile_regex_

Indicators of compromise

CVE-2026-73556cve

Original source: https://github.com/advisories/GHSA-48jh-3gj7-fg8v