CVE-2026-115911: vLLM chat template rendering denial of service via unbounded Jinja execution

Summary

From vLLM 0.19.0 through 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, and a malicious model repository can provide one as well. The template is rendered by tokenizer.apply_chat_template() with no wall-clock timeout, output-size limit, or iteration bound. A nonterminating render can block /v1/responses and other chat-template users, while an output-expanding render can exhaust server memory; Harmony models are not affected.

Mitigation

This issue is fixed in version 0.32.0.

Topics

• Inference infrastructure

Related items

• MediumCVE-2026-115913: vLLM out-of-memory crash via long audio clip to Phi-4 multimodal encoderSimilar attack · NVD/CVE Database
• MediumCVE-2026-116181: vLLM improper input validation of stop_token_ids crashes engineSimilar attack · NVD/CVE Database
• HighCVE-2026-116180: vLLM denial of service through prompt_logprobs on cached prefixesSimilar attack · NVD/CVE Database
• HighCVE-2026-116179: vLLM resource exhaustion through media_io_kwargs video frame-count overrideSimilar attack · NVD/CVE Database
• MediumCVE-2026-116178: vLLM denial of service via inconsistent multimodal metadataSimilar attack · NVD/CVE Database