Database/AI/ML frameworks & serving
vLLM: request-supplied chat template bypasses trust_request_chat_template and exhausts the server
Impact
When no server-side chat template is configured, an authenticated caller can put an arbitrary Jinja template in chat_template_kwargs[chat_template] on /v1/responses. ChatParams.get_apply_chat_template_kwargs() keeps that value without enforcing trust_request_chat_template, so the operator's intended trust policy does not apply and the rendering can burn CPU and memory until the serving process is starved. On a GPU node this denies service to every tenant sharing that vLLM instance while the GPUs sit idle behind a stuck frontend. Affects 0.16.0 through 0.31.x.
Who can reach it
Any caller authenticated to the vLLM API that can reach /v1/responses on an instance started without a chat template.
What to do
Upgrade to vLLM 0.32.0 and restart the serving processes. Until then, configure an explicit server-side chat template and/or reject chat_template_kwargs at the gateway.
References
Related entries
- MLflow: CrewAI autologging writes provider API keys in plaintext into tracesCVE-2026-116691 · MLflow CrewAI autologging (mlflow/crewai/autolog.py agent attribute capture)Medium
- Kubeflow Pipelines: frontend artifact routes skip namespace authorization, exposing other tenants' artifactsCVE-2026-118760 · Kubeflow Pipelines frontend (artifact routes, namespace authorization)Medium
- vLLM: unbounded frame count in video/jpeg base64 data URLs crashes the server with OOMCVE-2026-34755 · vLLM OpenAI-compatible API server (video/jpeg base64 multimodal path)Medium
- vLLM: no upper bound on the n parameter lets a single request OOM the API serverCVE-2026-34756 · vLLM OpenAI-compatible API server (ChatCompletionRequest/CompletionRequest n parameter)Medium
- vLLM (revision pinning): Revision pinning does not apply to all model artifactsCVE-2026-47155 · vLLM (revision pinning)Medium
- Starlette: malformed Host header makes request.url.path diverge from the routed pathCVE-2026-48710 · Starlette (Host header validation when reconstructing request.url)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.