Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115911— vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool

Quick assessment

Affected
vllm-project vllm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM 是一个面向大型语言模型的推理与服务引擎。在 0.19.0 至 0.32.0 版本中，已认证的调用方可以在服务器未配置 参数时，自行提供请求对话模板；或者，恶意模型仓库可提供一个模板，该模板会被 编译并渲染，且该过程缺乏实时超时限制、输出大小限制或迭代次数上限。由于渲染默认在一个仅含单个工作线程的 中执行，因此非终止的渲染操作会在请求结束后阻塞 及其他使用对话模板的接口，而输出膨胀型的渲染则可能耗尽服务器内存。Harmony 系列模型不受此问题影响，因为它们不经过该 Jinja 模板处理路径。该漏洞已在 0

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115911

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
Source: CVE Program / CVE List V5
Vulnerability Description
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vllm-project vllm >= 0.19.0, < 0.32.0 -

II. Public POCs for CVE-2026-115911

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115911

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115911 (2)

Vendor Advisories for CVE-2026-115911 (1)

Vendor Pages for CVE-2026-115911 (1)

Same Patch Batch · vllm-project · 2026-10-26 · 8 CVEs total

CVE-2026-115915 8.1 HIGH vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-115912 7.5 HIGH vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insec
CVE-2026-115913 6.5 MEDIUM vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a s
CVE-2026-115916 6.5 MEDIUM vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device
CVE-2026-115914 6.5 MEDIUM vLLM DeepSeek-OCR image processing vulnerable to denial of service
CVE-2026-115918 6.5 MEDIUM vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
CVE-2026-115917 3.4 LOW vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

IV. Related Vulnerabilities

Same product: vllm
Same vendor: vllm-project
Same weakness: CWE-400