fix(security): guard lm-format-enforcer regex compile with timeout (#47595)
Signed-off-by: jperezde <jperezde@redhat.com>
Juan Pérez de Algaba committed
Jul 14, 2026 at 09:18 UTC
c9a788eedc412acceaa5112e0d44624b49841577
1 file changed
+14
-1
vllm/v1/structured_output/backend_lm_format_enforcer.py
+14
-1
@@ -17,6 +17,7 @@ from vllm.v1.structured_output.backend_types import (
17
StructuredOutputGrammar,
18
StructuredOutputOptions,
19
)
20
+from vllm.v1.structured_output.utils import compile_regex_with_timeout
21
22
if TYPE_CHECKING:
23
import lmformatenforcer
@@ -107,7 +108,10 @@ class LMFormatEnforcerBackend(StructuredOutputBackend):
108
elif request_type == StructuredOutputOptions.JSON_OBJECT:
109
character_level_parser = lmformatenforcer.JsonSchemaParser(None)
110
elif request_type == StructuredOutputOptions.REGEX:
110
- character_level_parser = lmformatenforcer.RegexParser(grammar_spec)
111
+ character_level_parser = compile_regex_with_timeout(
112
+ lmformatenforcer.RegexParser,
113
+ grammar_spec,
114
+ )
115
elif request_type == StructuredOutputOptions.CHOICE:
116
choices = ast.literal_eval(grammar_spec)
117
character_level_parser = lmformatenforcer.UnionParser(
@@ -153,6 +157,15 @@ def validate_structured_output_request_lm_format_enforcer(params: SamplingParams
157
so_params = params.structured_outputs
158
159
if so_params.regex:
160
+ try:
161
+ compile_regex_with_timeout(
162
+ lmformatenforcer.RegexParser,
163
+ so_params.regex,
164
+ )
165
+ except Exception as err:
166
+ raise ValueError(
167
+ f"Failed to compile regex for lm-format-enforcer: {err}"
168
+ ) from err
169
return
170
elif so_params.json:
171
if isinstance(so_params.json, str):