CVE-2026-115918: vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

Q: Which deployments are exposed to this issue?

vLLM versions from 0.16.0 through versions before 0.32.0 are affected when the /v1/responses endpoint is available and no server chat template is configured. Version 0.32.0 fixes the issue.

Q: What access does an attacker need?

An attacker must be an authenticated caller able to send requests to /v1/responses. They can supply a template through chat_template_kwargs[chat_template] and trigger Jinja rendering.

Q: What is the practical impact of successful exploitation?

A malicious template can cause CPU or memory exhaustion during Jinja rendering, resulting in a denial of service. The reported CVSS vector indicates no user interaction is required and no confidentiality or integrity impact is identified.

Q: What can be done if upgrading is not immediately possible?

The exposed condition requires that no server chat template is configured. Configuring a server template avoids the described path that accepts an attacker-controlled chat_template value.

Published Oct 26, 2026

Updated

vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chattemplatekwargs[chattemplate] when no server template is configured. ChatParams.getapplychattemplatekwargs() preserves that value without enforcing trustrequestchattemplate, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.

Affected Software

1 affected component

vllm vllm>=0.16.0<0.32.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade vLLM to a version that resolves this vulnerability.
Fixed in 0.32.0

Event History

Oct 26, 2026

CVE Published

via MITRE·05:21 PM

Data Sourced

via MITRE·05:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

vLLM versions from 0.16.0 through versions before 0.32.0 are affected when the /v1/responses endpoint is available and no server chat template is configured. Version 0.32.0 fixes the issue.

What access does an attacker need?

An attacker must be an authenticated caller able to send requests to /v1/responses. They can supply a template through chat_template_kwargs[chat_template] and trigger Jinja rendering.

What is the practical impact of successful exploitation?

A malicious template can cause CPU or memory exhaustion during Jinja rendering, resulting in a denial of service. The reported CVSS vector indicates no user interaction is required and no confidentiality or integrity impact is identified.

What can be done if upgrading is not immediately possible?

The exposed condition requires that no server chat template is configured. Configuring a server template avoids the described path that accepts an attacker-controlled chat_template value.

CVE-2026-115918: vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the practical impact of successful exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the practical impact of successful exploitation?

What can be done if upgrading is not immediately possible?