{"data":{"id":"93384dc5-170c-4394-9a77-6a8c1c7e329e","title":"CVE-2026-90878: A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file…","summary":"A vulnerability in vllm-project vLLM up to 0.27.1 affects an unspecified part of the /v1/chat/completions endpoint, in the Jinja Template Rendering component. Manipulating the chat_template argument causes resource consumption, and the attack can be launched remotely. The exploit is publicly disclosed and may be used.","solution":"A pull request to fix this issue is awaiting acceptance. No fixed version is stated in the source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90878","publishedAt":"2026-09-15T05:16:59.420Z","cveId":"CVE-2026-90878","cweIds":["CWE-400","CWE-404"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM resource consumption through chat_template in /v1/chat/completions","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00533,"epssCheckedAt":"2026-11-04T12:08:34.339Z","kevDateAdded":null,"advisoryAliases":["GHSA-2h9j-24rv-h4c7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T00:10:47.334Z","patchAvailable":null,"disclosureDate":"2026-09-15T05:16:59.420Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}