vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs (vllm-project vllm)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.35 % · percentile 29 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Awaiting Analysis
Description
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
- CWE-770 — Allocation of Resources Without Limits or Throttling
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-x567-49g5-p4cf — vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
European references
- ENISA EUVD · EUVD-2026-110039
- GCVE · GCVE-0-2026-115918
Affected products
| Product | Versions |
|---|---|
| vllm-project · vllm | affected >= 0.16.0, < 0.32.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |