EUVD-2026-109996

vLLM: DoS via unbounded chattemplate Jinja2 rendering exhausts the renderer thread pool...

SUSE CVE-2026-115911

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...

CVE-2026-115918

A flaw was found in vLLM. This vulnerability allows an authenticated remote attacker to cause a Denial of Service DoS by submitting a request containing an untrusted chat template to the responses endpoint. When no server template is configured, the application fails to enforce template trust...

CVE-2026-115911

A flaw was found in vLLM. An authenticated remote attacker or a malicious model repository can cause a Denial of Service DoS by providing a specially crafted chat template. Because templates are rendered without execution timeouts or resource limits, processing the input can permanently block...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the chat template rendering engine, which processes user-supplied Jinja2-style templates...

PYSEC-2026-4344

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...

PYSEC-2026-4344

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...

CVE-2026-115911

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...

CVE-2026-115911

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...

PT-2026-125028

Name of the Vulnerable Software and Affected Versions vLLM versions 0.16.0 through 0.31.0 Description The '/v1/responses' endpoint allows an authenticated user to provide a malicious template via the chat template variable within chat template kwargs when no server template is configured. The get...

PT-2026-123434

Name of the Vulnerable Software and Affected Versions vLLM versions 0.19.0 through 0.31.0 Description Authenticated callers can provide a request chat template when no server-side --chat-template is configured. Additionally, a malicious model repository may provide a template that is compiled and...

vLLM resource management error vulnerability

Versions vLLM 0.19.0 through 0.32.0 contain a resource management error vulnerability. This vulnerability arises because authenticated callers can provide chat template requests when no server-side --chat-template is configured; alternatively, malicious model repositories may supply templates...

Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection

Prompt injection against LLM agents becomes much stronger when the injected instruction is wrapped in the model's own chat template. A forged template marker such as can reach the model either as a single reserved control token or as a sequence of ordinary subword tokens. The two decode to exactl...

PT-2026-91857

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat template causes resource consumption. The attack can be initiated remotely. The exploit...

PYSEC-2026-3929 Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

Malicious code in dpais-chat-template-pwa (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 4d39545ec9be8c0beabaaf1f508b0f468a884898b3fb8b8ae6d73b5cb62c54fc The OpenSSF Package Analysis project identified 'dpais-chat-template-pwa' @ 11.2.1 npm as malicious. It is considered malicious...

A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw

Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself. The findings were shared with The Hacker News ahead of...

GHSA-XRQW-3RRV-VX5W Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...