4 matches found
CVE-2026-115911
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...
EUVD-2026-109996
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...
CVE-2026-115911 vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by...
CVE-2026-115911
The vLLM inference and serving engine (versions 0.19.0 through 0.32.0 ) is vulnerable to a Denial of Service (DoS) attack due to unbounded Jinja2 rendering in the tokenizer.apply_chat_template() function. Authenticated callers can provide a request chat template (when no server-side template is c...