Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115918— vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

Quick assessment

Affected
vllm-project vllm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM 是一个用于大型语言模型的推理与服务引擎。在版本 0.16.0 至 0.32.0 期间，/v1/responses 接口允许已认证的调用方在服务器未配置模板时，将攻击者控制的模板放入 中。由于 方法在保存该值时未强制检查 标志，导致请求可绕过预期的信任策略，并通过 Jinja 模板渲染引发 CPU 或内存资源耗尽。该问题已在版本 0.32.0 中修复。

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115918

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
Source: CVE Program / CVE List V5
Vulnerability Description
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vllm-project vllm >= 0.16.0, < 0.32.0 -

II. Public POCs for CVE-2026-115918

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115918

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115918 (2)

Vendor Advisories for CVE-2026-115918 (1)

Vendor Pages for CVE-2026-115918 (1)

Same Patch Batch · vllm-project · 2026-10-26 · 8 CVEs total

CVE-2026-115915 8.1 HIGH vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-115912 7.5 HIGH vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insec
CVE-2026-115911 6.5 MEDIUM vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
CVE-2026-115913 6.5 MEDIUM vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a s
CVE-2026-115916 6.5 MEDIUM vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device
CVE-2026-115914 6.5 MEDIUM vLLM DeepSeek-OCR image processing vulnerable to denial of service
CVE-2026-115917 3.4 LOW vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server

IV. Related Vulnerabilities

Same product: vllm
Same vendor: vllm-project
Same weakness: CWE-400