GHSA-vfm7-4h43-gp6m

Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service

Published

2026-06-20

Modified

2026-09-11

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j828-28rj-hfhp. This link is maintained to preserve external references. ### Original Description vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker submitting crafted input with nested or repeated structures can trigger severe CPU consumption and performance degradation, resulting in denial of service.

Affected packages

Remediation: Upgrade to 0.9.0 or later.

References

• https://github.com/advisories/GHSA-vfm7-4h43-gp6m