{"id":"CVE-2026-115918","kind":"vulnerability","aliases":["CVE-2026-115918"],"related":[],"title":"vLLM: authenticated users can inject chat templates, exhausting CPU and memory","description":"vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.","summary":"vLLM's /v1/responses endpoint accepts an attacker-controlled Jinja chat template when the server has no template configured, bypassing the intended trust policy. An authenticated caller can use this to exhaust CPU or memory on the server through template rendering.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","python","self-hosted","vllm"],"not_affected_if":["no-authenticated-users","server-chat-template-configured","version-outside-0.16.0-0.32.0"],"how_to_check":"- Check the installed vLLM version with `pip show vllm` and confirm whether it is between `0.16.0` and `0.32.0`.\n- Check whether the deployment serves the `/v1/responses` endpoint and whether a server chat template is configured.","fix":"- Upgrade vLLM to `0.32.0` or later.","status":"open","published_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:34:00+00:00","updated_at":"2026-10-26T18:34:00+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T18:34:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.32.0` or later.","reach":"network","title":"vLLM: authenticated users can inject chat templates, exhausting CPU and memory","impact":"medium","summary":"vLLM's /v1/responses endpoint accepts an attacker-controlled Jinja chat template when the server has no template configured, bypassing the intended trust policy. An authenticated caller can use this to exhaust CPU or memory on the server through template rendering.","category":"ai-tooling","nicknames":[],"who_cares":["vllm","python","self-hosted","llm-serving"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated callers exhaust CPU or memory, causing denial of service on the server.","analyst_note":"Confirm the trust_request_chat_template default and whether a server template is typical; check the fix commit or advisory for workarounds besides upgrading.","how_to_check":"- Check the installed vLLM version with `pip show vllm` and confirm whether it is between `0.16.0` and `0.32.0`.\n- Check whether the deployment serves the `/v1/responses` endpoint and whether a server chat template is configured.","needs_analyst":true,"not_affected_if":["version-outside-0.16.0-0.32.0","no-authenticated-users","server-chat-template-configured"],"who_is_affected":"Teams running vLLM between `0.16.0` and `0.32.0` that expose the `/v1/responses` endpoint to callers with credentials and do not configure a server chat template. Deployments on versions outside that range, or without the endpoint exposed to authenticated users, are not affected by this report.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":3380,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115918':14A,17A '-2026':13A,16A '/v1/responses':31B,86C '0.16.0':82C '0.32.0':84C,149C 'accept':33B 'ai':19B 'ai-tool':18B 'allow':88C 'appli':112C 'attack':36B,96C 'attacker-control':35B,95C 'authent':2A,54B,90C 'bypass':48B,129C 'caller':55B,91C 'caus':135C 'chat':6A,39B,100C,103C,113C,123C 'chatparams.get':111C 'configur':47B,110C 'control':37B,97C 'cpu':9A,61B,136C 'cve':12A,15A 'endpoint':32B,87C 'enforc':120C 'engin':76C 'exhaust':8A,60B,139C 'fix':146C 'host':27B 'infer':73C 'inject':5A 'intend':50B,131C 'issu':144C 'jinja':38B,141C 'kwarg':102C,115C 'languag':79C 'larg':78C 'llm':22B 'llm-serv':21B 'memori':11A,63B,138C 'model':80C 'place':93C 'polici':52B,133C 'preserv':116C 'python':24B 'render':69B,142C 'request':122C,127C 'self':26B 'self-host':25B 'serv':23B,75C 'server':43B,66B,107C 'templat':7A,40B,46B,68B,98C,101C,104C,108C,114C,124C 'tool':20B 'trust':51B,121C,132C 'use':57B 'user':3A 'valu':118C 'version':148C 'vllm':1A,28B,29B,70C 'without':119C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM between `0.16.0` and `0.32.0` that expose the `/v1/responses` endpoint to callers with credentials and do not configure a server chat template. Deployments on versions outside that range, or without the endpoint exposed to authenticated users, are not affected by this report.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115918","severity":null,"published_at":"2026-10-26T18:17:39+00:00","modified_at":"2026-10-26T18:17:39+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}