Live › vulnerability › CVE-2026-115911
Go to dashboardvLLM versions from 0.19.0 through 0.32.0 render Jinja chat templates supplied in requests, or shipped by a malicious model repository, with no timeout, output limit or iteration bound. An authenticated caller can send a template that never finishes, blocking /v1/responses and other chat endpoints, or one that expands output until server memory runs out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
Teams running vLLM between 0.19.0 and 0.32.0 that serve chat or responses endpoints to callers who can send request-level chat templates, or that load models from repositories they do not control. Deployments that set a server-side --chat-template still accept no request template, but the issue is not confirmed for that case. Harmony models do not use this code path.
No product ranges from the sources yet.
pip show vllm or python -c "import vllm; print(vllm.__version__)", and check whether the server was started with --chat-template.0.32.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115911")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.