CVE-2026-115911
Full vulnerability record from the local CVENow database.
Description
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0.
View original CVE JSON
{
"id": "CVE-2026-115911",
"sourceIdentifier": "[email protected]",
"published": "2026-10-26T17:17:18.753",
"lastModified": "2026-10-28T15:38:39.203",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "vllm-project",
"product": "vllm",
"versions": [
{
"version": ">= 0.19.0, < 0.32.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-400"
},
{
"lang": "en",
"value": "CWE-770"
},
{
"lang": "en",
"value": "CWE-834"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.19.0",
"versionEndExcluding": "0.32.0",
"matchCriteriaId": "29923C7C-A5D6-4405-85C7-5678B17164B4"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/vllm-project/vllm/pull/50300",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/vllm-project/vllm/releases/tag/v0.32.0",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-542m-9234-8gvf",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}