vLLM Rust frontend DoS via nested range in untrusted chat_template

Vulnerability Overview Title: Rust frontend does not enforce an evaluation budget when rendering caller-provided templates; a 116-byte request body can consume 55 CPU seconds (Issue #52025, Status: Open, Label: Bug). Root Cause: The Rust frontend renders the provided by the caller within the request body without any evaluation budget/limit. An attacker can trigger extensive expansion of nested calls using a minimal request body (116 bytes), causing a single request to occupy a request-processing thread for up to 55 seconds, resulting in a reproducible Denial of Service (DoS). Key Data: Depth 3, range 116 bytes, 64,900,000 iterations, ~3.659 seconds; Depth 4, range 116 bytes, 997,002,999 iterations, ~55.6 seconds. Impact Scope Affected Component: (reached via ). Impact: Remote, unauthenticated, reproducible DoS — an attacker can block request-processing threads with a tiny request body, causing endpoints such as to stop responding; concurrent malicious requests can saturate all worker threads. Insufficient Existing Defenses: - only limits individual nested traversals but does not limit total evaluation volume; - 's runtime uses an independent pool ( ), and rendering is a synchronous call without a timeout; - Security guidelines already impose limits on image/audio/video pre-processing (e.g., ), but no corresponding limit exists for template evaluation. Cannot Be Disabled via Configuration: Python vLLM provides a toggle (default ), but the Rust frontend has not implemented this flag; results in a hard startup error in the Rust frontend, while the request field is still accepted and reaches the renderer. Remediation (Suggested) 1. Limit Template Evaluation: Enable in minijinja, or wrap with a wall-clock budget to close the vulnerability regardless of who provides the template. 2. Implement , default : Align with Python vLLM by removing caller-provided templates. 3. Intended Endpoints: Consider accepting in the request body instead of leaving it uncontrollable by operators. 4. Independently: Treat the renderer similarly to a multimodal preprocessor, keeping it secure. POC / Exploitation Code 116-byte template (in ): Rust POC (reproduced via , from 's ): Configuration/CLI Examples ( causes a hard startup error under the Rust frontend): Relevant Source Code Locations: : calls and . : A comment notes that CPU-intensive request pre-processing should not occupy HTTP request-processing threads. : (a 116-byte request body can trigger 55 seconds).

Goal Reached Thanks to every supporter — we hit 100%!

vLLM Rust frontend DoS via nested range in untrusted chat_template

More from this source