vLLM: unbounded chat-template rendering lets one request wedge or exhaust the serving process

Impact

When no server-side --chat-template is configured, a caller can supply a chat template with the request, and a malicious model repository can ship one; either is compiled and rendered by tokenizer.apply_chat_template() with no wall-clock timeout, output-size cap, or iteration bound. Rendering runs in a ThreadPoolExecutor that defaults to a single worker, so a non-terminating template keeps occupying that worker after the request has ended and /v1/responses plus every other chat-template consumer stops making progress. An output-expanding template instead grows host memory until the process is killed. On a GPU node that is the whole endpoint for every tenant sharing the model, and recovery means restarting the server and reloading weights onto the device. Harmony models do not use this Jinja path and are unaffected.

Who can reach it

An authenticated caller of the OpenAI-compatible API (CVSS: network, low privileges) on a server started without --chat-template, or anyone who controls the model repository the server loads from.

What to do

Upgrade to vLLM 0.32.0 (fix commit cff08b46) and restart the serving processes; weights reload, so expect the usual model-load outage per replica rather than a node drain. Until then, start the server with an explicit trusted --chat-template so request-supplied templates are not used, and load models only from repositories you control.

References

Related entries

• vLLM: Phi-4 audio encoder materializes quadratic attention matrices, letting one long clip OOM the engineCVE-2026-115913 · vLLM Phi-4 multimodal audio encoder (phi4mm_audio.py eager attention)Medium
• vLLM: an all-zero image on the DeepSeek-OCR path trips a fatal assertion and shuts the engine downCVE-2026-115914 · vLLM DeepSeek-OCR image path (_parse_and_validate_image_input / sanity_check_mm_encoder_outputs)Medium
• vLLM: off-by-one prompt-token-ID bound lets a request crash the inference engineCVE-2026-115916 · vLLM tokenizer input validation (vllm/tokenizers/hf.py max_token_id)Medium
• vLLM: request-supplied chat template bypasses trust_request_chat_template and exhausts the serverCVE-2026-115918 · vLLM /v1/responses endpoint (chat_template_kwargs trust policy)Medium
• MLflow: CrewAI autologging writes provider API keys in plaintext into tracesCVE-2026-116691 · MLflow CrewAI autologging (mlflow/crewai/autolog.py agent attribute capture)Medium
• Kubeflow Pipelines: frontend artifact routes skip namespace authorization, exposing other tenants' artifactsCVE-2026-118760 · Kubeflow Pipelines frontend (artifact routes, namespace authorization)Medium