---
id: "CVE-2026-115918"
kind: "vulnerability"
aliases: ["CVE-2026-115918"]
title: "vLLM: authenticated users can inject chat templates, exhausting CPU and memory"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "llm-serving", "python", "self-hosted", "vllm"]
not_affected_if: ["no-authenticated-users", "server-chat-template-configured", "version-outside-0.16.0-0.32.0"]
published_at: "2026-10-26T18:17:39+00:00"
first_seen_at: "2026-10-26T18:31:43+00:00"
updated_at: "2026-10-26T18:34:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115918", "first_seen_at": "2026-10-26T18:31:43+00:00"}]
---

# vLLM: authenticated users can inject chat templates, exhausting CPU and memory

vLLM's /v1/responses endpoint accepts an attacker-controlled Jinja chat template when the server has no template configured, bypassing the intended trust policy. An authenticated caller can use this to exhaust CPU or memory on the server through template rendering.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed vLLM version with `pip show vllm` and confirm whether it is between `0.16.0` and `0.32.0`.
- Check whether the deployment serves the `/v1/responses` endpoint and whether a server chat template is configured.

## Fix

- Upgrade vLLM to `0.32.0` or later.

## Timeline

- 2026-10-26T18:31:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115918

## From the sources

vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_