GitHub published GHSA-48jh-3gj7-fg8v at 21:37:00 UTC on 4 September — CVE-2026-73556, CVSS 5.3, against vLLM, the most widely deployed open-source inference server. It reads in feeds as a new denial-of-service bug. It is the same bug the project fixed in July, surviving in the code path the fix did not touch.
The sibling path
The advisory is explicit: "The fix for GHSA-rwxx-mrjm-wc2m … wrapped the regex compile in the xgrammar and outlines backends with compile_regex_with_timeout (and, for outlines, validate_regex_is_buildable). The lm-format-enforcer backend was left unguarded: it compiles the attacker-supplied regex with no timeout and no buildability check." All three backends reach the same interegular DFA construction; two of them are bounded and one is not.
The measurement
The advisory publishes its own timings: baseline '[0-9]{3}' compiles in 0.0002 s; the attacker's '(a{1,300}){300}' did not complete in 20 s, "one core pegged at 100% in interegular FSM construction". Because grammar compilation runs inside the engine's structured-output path, the request never returns and concurrent requests stall behind it — worker-level denial of service. The advisory notes the identical request against the outlines backend returns a clean error.
What the received framing gets wrong
Two things. This is a patch-completeness failure, not a new class of attack — the interesting fact is that a security fix landed in two of three sibling call sites and nobody noticed for six weeks. And "affected versions < 0.26.0" reads as current exposure: 0.26.0 shipped on 27 July and the current release is 0.28.0, so the disclosure trails the fix by 39 days. Anyone tracking their vLLM version was never exposed after July; anyone pinned below it has been, unaware, since.
The precondition that is not much of one
The advisory records that "vLLM ships with no authentication by default". The attack is a single POST to /v1/completions with a structured-output regex — no credentials, no model access beyond the endpoint, no special configuration except selecting the lm-format-enforcer backend. Structured output is the feature most production deployments turn on, because it is how JSON responses are made reliable.