vLLM: attacker-supplied chat_template burns server resources on the GPU node

Impact

A request to /v1/chat/completions can pass a chat_template argument that vLLM renders with Jinja, and a crafted template drives resource consumption in the server process. The practical effect on a serving fleet is that one authenticated caller can degrade or stall an endpoint that owns whole GPUs, so the harm is not just to that caller's request but to every tenant queued behind it on the same replica; requests back up and the scheduler cannot reclaim the accelerators until the process is restarted. Rated low (CVSS 2.1) and limited to availability - no data disclosure or code execution is claimed in the record. The report states the exploit is public and that the fix is still an unmerged pull request.

Who can reach it

Anyone who can send an authenticated request to the vLLM HTTP API - on most deployments that means any tenant or any service holding an API key for the endpoint. Remote, low privileges, no user interaction.

What to do

No fixed release as of this record: the upstream fix is pull request vllm-project/vllm#52163 and is still awaiting acceptance, affecting vLLM up to 0.27.1. Mitigate at the front door - strip or reject a client-supplied chat_template at the gateway or proxy in front of vLLM and serve only the template shipped with the model, and keep per-caller request timeouts and concurrency caps so one request cannot hold a replica indefinitely. When the fix ships, upgrading is a rolling restart of the serving processes; no node drain or reboot is involved.

References

Related entries

• PowerInfer: unvalidated data_offset in the GGUF parser causes an out-of-bounds read when loading a modelCVE-2026-108955 · PowerInfer GGUF parser (gguf_init_from_file, data_offset)Low
• PowerInfer: out-of-bounds read in the CUDA FFN GPU-split loader while staging weights to the deviceCVE-2026-108960 · PowerInfer CUDA FFN GPU-split loader (create_striped_mat_to_gpu)Low
• vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU nodeCVE-2026-90713 · vLLM (Rust tiktoken vocab file handler, TiktokenTokenizer::new)Low
• LangChain4j agentic: unsafe Jackson default typing in AgenticScope deserialization allows arbitrary class instantiationCVE-2026-97869 · LangChain4j agentic module (AgenticScopeSerializer JSON deserialization)Low
• Langchain-Chatchat: arbitrary file write outside the upload and knowledge-base directoriesCVE-2026-51882 · Langchain-Chatchat (file upload and knowledge-base endpoints, path traversal)Unscored
• llama.cpp: a crafted GGUF file trips a reachable assertion and aborts the process loading itCVE-2026-52131 · llama.cpp (gguf_reader::read GGUF model file parser)Unscored