CVE-2026-115911: vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.applychattemplate() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to request-supplied templates?
Deployments running versions from 0.19.0 until 0.32.0 are exposed when no server-side --chat-template is configured, because authenticated callers can then provide a chat template in a request. Harmony models are not affected because they do not use this Jinja rendering path.
Can a malicious model repository trigger the issue without a caller supplying a template?
Yes. A malicious model repository can provide a template that is compiled and rendered through tokenizer.apply_chat_template(), allowing nonterminating rendering or output expansion.
What is the practical impact of a nonterminating template render?
Rendering uses a ThreadPoolExecutor with one worker by default. A nonterminating render can block /v1/responses and other chat-template users even after the triggering request has ended; an output-expanding render can exhaust server memory.
What can be done if upgrading is not immediately possible?
Configure a server-side --chat-template to prevent authenticated callers from supplying request chat templates. Avoid using model repositories whose templates are not trusted, since repository-provided templates can also trigger the vulnerable rendering path.
What version contains the fix?
The issue is fixed in vLLM version 0.32.0.