CVE-2026-115911

vLLM chat-template rendering can exhaust CPU or memory

vLLM project · vLLM Python chat-template renderer

First documented disclosure · Review checkpoint

Summary

A hostile chat template could block shared rendering capacity or exhaust server memory.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Jinja rendering lacked execution and output bounds; its default single worker could remain occupied after a client disconnect.

Conditions required

An authenticated caller can supply a template when no server template is configured, or the operator loads a malicious model template. Harmony models do not use this path.

Potential impact

Denial of chat-style inference for other tenants of the API-server replica until restart.

Affected versions and configurations

0.19.0 through versions before 0.32.0.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade, use trusted server templates, and enforce template execution and output limits.

Operating lesson

A template sandbox that blocks code execution still needs resource limits.

Evidence and limits

Public July 29 security-fix discussion precedes October 20 advisory and October 26 CVE publication. Distinct from the request-policy bypass CVE-2026-115918, although both share a fix. No production attack is established.

Sources