Live › vulnerability › CVE-2026-115918
Go to dashboardvLLM's /v1/responses endpoint accepts an attacker-controlled Jinja chat template when the server has no template configured, bypassing the intended trust policy. An authenticated caller can use this to exhaust CPU or memory on the server through template rendering.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams running vLLM between and that expose the endpoint to callers with credentials and do not configure a server chat template. Deployments on versions outside that range, or without the endpoint exposed to authenticated users, are not affected by this report.
0.16.00.32.0/v1/responsesNo product ranges from the sources yet.
pip show vllm and confirm whether it is between 0.16.0 and 0.32.0./v1/responses endpoint and whether a server chat template is configured.0.32.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115918")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.