CVE-2026-115918: vLLM Jinja chat template injection through /v1/responses endpoint

Summary

CVE-2026-115918 affects vLLM, an inference and serving engine for large language models, from version 0.16.0 through 0.32.0. An authenticated caller of the /v1/responses endpoint can supply an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured, because ChatParams.get_apply_chat_template_kwargs() keeps that value without enforcing trust_request_chat_template. The bypassed trust policy lets the attacker exhaust CPU or memory through Jinja rendering.

Mitigation

Fixed in 0.32.0.

Topics

• Inference infrastructure

Related items

• MediumCVE-2026-115922: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…Similar attack · NVD/CVE Database
• MediumCVE-2026-115921: ONNX shape inference crash from malicious model scan attributesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115920: ONNX ConvTranspose shape inference crash from malformed weight tensorSimilar attack · NVD/CVE Database
• MediumCVE-2026-115919: ONNX shape inference out-of-bounds read via malformed RNN, LSTM and GRU nodesSimilar attack · NVD/CVE Database
• LowCVE-2026-115917: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server…Similar attack · NVD/CVE Database