vllm - Regular Expression Denial of Service in Multiple Components
Description
vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Multiple regex patterns use non-greedy or greedy `.*` inside groups, enabling catastrophic backtracking on crafted input."
Attack vector
An attacker sends crafted input containing nested or repeated structures — such as deeply nested parentheses, repeated brackets, or long strings with repeated patterns — to any endpoint that processes the vulnerable regexes. The regex engine's catastrophic backtracking causes severe CPU consumption and performance degradation, leading to denial of service [CWE-1333]. The advisory notes that the benchmark file is used for correctness checking but should still handle abnormal inputs carefully [ref_id=1].
Affected code
The vulnerable regex patterns are located in `vllm/lora/utils.py` (line 173), `vllm/entrypoints/openai/tool_parsers/phi4mini_tool_parser.py` (line 52), `vllm/entrypoints/openai/serving_chat.py` (line 351), and `benchmarks/benchmark_serving_structured_output.py` (line 650). Each pattern uses non-greedy or greedy `.*` inside groups, making them susceptible to catastrophic backtracking on crafted input [ref_id=1].
What the fix does
The advisory recommends limiting input string length, using non-recursive matching approaches, imposing length constraints on matched content, and preferring structured parsing (e.g., JSON parsing) over regex for extracting structured data [ref_id=1]. The fix is referenced as pull request #18454, though the advisory does not detail the exact code changes in that PR [ref_id=1].
Preconditions
- networkAttacker must be able to send input that reaches one of the vulnerable regex patterns (e.g., via the chat endpoint, tool parser, or LoRA module).
- authNo authentication is required if the vulnerable endpoint is exposed without access control.
Generated on Jun 21, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/vllm-project/vllm/security/advisories/GHSA-j828-28rj-hfhpmitrevendor-advisory
- www.vulncheck.com/advisories/vllm-regular-expression-denial-of-service-in-multiple-componentsmitrethird-party-advisory
News mentions
0No linked articles in our index yet.