vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

SummaryThe fix for GHSA-rwxx-mrjm-wc2m "ReDoS via structuredoutputs.regex compiled without timeout" wrapped the regex compile in the xgrammar and outlines backends with compileregexwithtimeout and, for outlines, validateregexisbuildable. The lm-format-enforcer backend was left unguarded: it...

CVE-2026-8376 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined substring buffer in characters...