Four vLLM advisories in one batch, and the regex one matters most.

GitHub published four medium-severity vLLM advisories on September 4 against the inference server most self-hosted agent stacks run on. GHSA-pr7f-p5mw-fc87 shows the CVE-2025-62164 remediation can be bypassed using concurrent prompt parts. GHSA-48jh-3gj7-fg8v is a ReDoS through structured_outputs.regex in the lm-format-enforcer backend with no compile timeout. GHSA-hwrm-c4cx-rf4j leaks internal paths and the username through unauthenticated validation errors. Structured outputs are how tool calling gets constrained, so the ReDoS is the one that touches every agent deployment (GitHub Advisories).