CVE-2026-115918

vLLM Responses route bypasses the request-template trust gate

vLLM project · vLLM /v1/responses

First documented disclosure · Review checkpoint

Summary

An authenticated caller could supply a chat template despite request-template trust being disabled.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The Responses route preserved a nested chat_template value without applying the validation used by sibling routes.

Conditions required

No explicit server-side chat template and a caller able to send Responses requests.

Potential impact

CPU or memory exhaustion through request-controlled Jinja rendering.

Affected versions and configurations

0.16.0 through versions before 0.32.0 per the CNA; the advisory’s source sweep lists 0.16.0–0.23.0 and then-current main.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade and apply consistent template-policy checks to every route.

Operating lesson

A trust policy is only effective when all equivalent input paths enforce it.

Evidence and limits

Public July 29 patch predates October 20 advisory and October 26 CVE publication. Separate from unbounded-rendering CVE-2026-115911; the two share a patch but cover different controls.

Sources