{"id":"CVE-2026-115911","kind":"vulnerability","aliases":["CVE-2026-115911"],"related":[],"title":"vLLM: unbounded chat template rendering lets requests hang or exhaust memory","description":"vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0.","summary":"vLLM versions from 0.19.0 through 0.32.0 render Jinja chat templates supplied in requests, or shipped by a malicious model repository, with no timeout, output limit or iteration bound. An authenticated caller can send a template that never finishes, blocking /v1/responses and other chat endpoints, or one that expands output until server memory runs out.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","python","self-hosted","vllm"],"not_affected_if":["auth-required","harmony-models","managed-hosting"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"`, and check whether the server was started with `--chat-template`.\n- Check whether the service accepts request-supplied chat templates and whether it loads models from untrusted repositories.","fix":"- Upgrade vLLM to `0.32.0` or later.\n- Until upgraded, restrict who can call the API and only load models from trusted repositories.","status":"open","published_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","triaged_at":"2026-10-26T17:33:19+00:00","updated_at":"2026-10-26T17:33:19+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T17:33:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.32.0` or later.\n- Until upgraded, restrict who can call the API and only load models from trusted repositories.","reach":"network","title":"vLLM: unbounded chat template rendering lets requests hang or exhaust memory","impact":"medium","summary":"vLLM versions from 0.19.0 through 0.32.0 render Jinja chat templates supplied in requests, or shipped by a malicious model repository, with no timeout, output limit or iteration bound. An authenticated caller can send a template that never finishes, blocking /v1/responses and other chat endpoints, or one that expands output until server memory runs out.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","self-hosted","llm-serving","python"],"confidence":0.7,"needs_auth":"yes","worst_case":"Chat endpoints hang or server memory is exhausted, causing denial of service.","analyst_note":"Check the vLLM GitHub security advisory for this CVE to confirm the affected range and whether a server-side --chat-template changes exposure.","how_to_check":"- Check the installed vLLM version with `pip show vllm` or `python -c \"import vllm; print(vllm.__version__)\"`, and check whether the server was started with `--chat-template`.\n- Check whether the service accepts request-supplied chat templates and whether it loads models from untrusted repositories.","needs_analyst":true,"not_affected_if":["harmony-models","managed-hosting","auth-required"],"who_is_affected":"Teams running vLLM between 0.19.0 and 0.32.0 that serve chat or responses endpoints to callers who can send request-level chat templates, or that load models from repositories they do not control. Deployments that set a server-side --chat-template still accept no request template, but the issue is not confirmed for that case. Harmony models do not use this code path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":3429,"output_tokens":677,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115911':14A,17A '-2026':13A,16A '/v1/responses':68B,162C '0.19.0':32B,94C '0.32.0':34B,96C,202C 'affect':187C 'ai':19B 'ai-tool':18B 'authent':58B,97C 'block':67B,161C 'bound':56B,145C 'caller':59B,98C 'chat':3A,37B,71B,103C,111C,131C,166C 'chat-templ':110C,165C 'clock':137C 'compil':126C 'configur':114C 'cve':12A,15A 'default':155C 'end':172C 'endpoint':72B 'engin':88C 'exhaust':10A,180C 'expand':76B,177C 'finish':66B 'fix':199C 'hang':8A 'harmoni':183C 'host':27B 'infer':85C 'issu':197C 'iter':55B,144C 'jinja':36B,194C 'languag':91C 'larg':90C 'let':6A 'limit':53B,142C 'llm':22B 'llm-serv':21B 'malici':46B,117C 'memori':11A,80B,182C 'model':47B,92C,118C,184C 'never':65B 'nontermin':158C 'one':74B,152C 'output':52B,77B,140C,176C 'output-expand':175C 'output-s':139C 'path':195C 'provid':121C 'python':24B 'render':5A,35B,128C,146C,159C,178C 'repositori':48B,119C 'request':7A,41B,102C,171C 'run':81B,147C 'self':26B 'self-host':25B 'send':61B 'serv':23B,87C 'server':79B,108C,181C 'server-sid':107C 'ship':43B 'side':109C 'size':141C 'suppli':39B,100C 'templat':4A,38B,63B,104C,112C,123C,132C,167C 'threadpoolexecutor':150C 'timeout':51B,138C 'tokenizer.apply':130C 'tool':20B 'unbound':2A 'use':192C 'user':168C 'version':30B,201C 'vllm':1A,28B,29B,82C 'wall':136C 'wall-clock':135C 'without':133C 'worker':153C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM between 0.19.0 and 0.32.0 that serve chat or responses endpoints to callers who can send request-level chat templates, or that load models from repositories they do not control. Deployments that set a server-side --chat-template still accept no request template, but the issue is not confirmed for that case. Harmony models do not use this code path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115911","severity":null,"published_at":"2026-10-26T17:17:18+00:00","modified_at":"2026-10-26T17:17:18+00:00","first_seen_at":"2026-10-26T17:31:22+00:00","fetched_at":"2026-10-26T17:31:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}