vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a request chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template that is compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker by default, so a nonterminating render can block /v1/responses and other chat-template users after the request ends, while an output-expanding render can exhaust server memory. Harmony models are not affected because they do not use this Jinja path. This issue is fixed in version 0.32.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134 Patch
- https://github.com/vllm-project/vllm/pull/50300 Patch
- https://github.com/vllm-project/vllm/security/advisories/GHSA-542m-9234-8gvf Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 6
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-28 15:38
- StatusPublished → AnalyzedNVD modified 2026-10-28 15:38
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-26 16:47
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-26 18:34
- StatusReceived → PublishedNVD modified 2026-10-26 16:47
- First seenCVSS 6.5NVD modified 2026-10-26 17:17
Affected (CPE criteria) 1
cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*
References 4
- https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134 Patch
- https://github.com/vllm-project/vllm/pull/50300 Patch
- https://github.com/vllm-project/vllm/releases/tag/v0.32.0 Release Notes
- https://github.com/vllm-project/vllm/security/advisories/GHSA-542m-9234-8gvf Patch, Vendor Advisory