vLLM: attacker-supplied chat_template burns server resources on the GPU node

Impact

A request to /v1/chat/completions can pass a chat_template argument that vLLM renders with Jinja, and a crafted template drives resource consumption in the server process. The practical effect on a serving fleet is that one authenticated caller can degrade or stall an endpoint that owns whole GPUs, so the harm is not just to that caller's request but to every tenant queued behind it on the same replica; requests back up and the scheduler cannot reclaim the accelerators until the process is restarted. Rated low (CVSS 2.1) and limited to availability - no data disclosure or code execution is claimed in the record. The report states the exploit is public and that the fix is still an unmerged pull request.

Who can reach it

Anyone who can send an authenticated request to the vLLM HTTP API - on most deployments that means any tenant or any service holding an API key for the endpoint. Remote, low privileges, no user interaction.

What to do

No fixed release as of this record: the upstream fix is pull request vllm-project/vllm#52163 and is still awaiting acceptance, affecting vLLM up to 0.27.1. Mitigate at the front door - strip or reject a client-supplied chat_template at the gateway or proxy in front of vLLM and serve only the template shipped with the model, and keep per-caller request timeouts and concurrency caps so one request cannot hold a replica indefinitely. When the fix ships, upgrading is a rolling restart of the serving processes; no node drain or reboot is involved.

References

Related entries

• vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU nodeCVE-2026-90713 · vLLM (Rust tiktoken vocab file handler, TiktokenTokenizer::new)Low
• llama.cpp: a crafted GGUF file trips a reachable assertion and aborts the process loading itCVE-2026-52131 · llama.cpp (gguf_reader::read GGUF model file parser)Unscored
• llama.cpp server: negative top_n on /rerank drives an unbounded allocation and denial of serviceCVE-2026-52132 · llama.cpp server /rerank endpoint (top_n handling under --reranking)Unscored
• Hugging Face Transformers: load_custom_generate writes remote code to disk before the trust checkCVE-2026-80047 · Hugging Face Transformers (dynamic_module_utils.py, load_custom_generate remote-code cache)Unscored
• SGLang: unauthenticated pickle deserialization on /update_weights_from_tensor gives code executionCVE-2026-86793 · SGLang inference server (/update_weights_from_tensor, SafeUnpickler)Unscored
• Jupyter Notebook (untrusted notebooks): Untrusted notebook executes JavaScript in the user's session on openCVE-2021-32798 · Jupyter Notebook (untrusted notebooks)Critical