Description

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-15T05:16:59.420Z",
  "pubdate": "2026-09-15T05:16:59.420Z",
  "executiveSummary": "A resource consumption vulnerability exists in the Jinja Template Rendering component of vLLM, affecting versions up to 0.27.1.\nThe vulnerability originates from the improper handling of the 'chat_template' argument within the '/v1/chat/completions' endpoint.\nBy submitting a maliciously crafted 'chat_template' payload, a remote, unauthenticated attacker can induce excessive resource consumption, potentially leading to a Denial of Service (DoS) state.\nThis vulnerability is critical due to its remote exploitability and the potential for service degradation on infrastructure running vLLM.\nPublic disclosure of the exploit increases the risk of immediate exploitation, making the prompt implementation of defensive measures essential for maintainers and users of the affected product.",
  "technicalDetails": "The vulnerability resides within the Jinja2 template rendering engine utilized by the vLLM API to process chat completions. The 'chat_template' argument, which is intended to allow users to define custom formatting for chat messages, is passed directly into the Jinja2 environment without sufficient validation or complexity constraints.\nThe root cause is an insecure integration of the template engine that fails to enforce resource limits on template evaluation. Because Jinja2 supports complex logical operations, loops, and recursive lookups, an attacker can supply a specifically crafted template that triggers exponential complexity, excessive memory allocation, or long-running execution during the rendering phase.\nThe attack flow begins with a remote, unauthenticated HTTP POST request to the '/v1/chat/completions' endpoint. The attacker includes a malicious payload within the 'chat_template' parameter. Upon receiving the request, the vLLM service parses the 'chat_template' and invokes the rendering engine to generate the formatted chat prompt. The malicious template exploits the rendering engine's recursive or high-complexity execution paths, causing the process to consume disproportionate amounts of CPU and memory.\nThis results in a resource exhaustion scenario that can hang the application process, leading to service latency or total failure for legitimate requests. Since this component is central to the inference pipeline, successful exploitation effectively renders the entire vLLM deployment unavailable to other users.\nThe vulnerability is present in all versions up to 0.27.1. It requires no specific authentication or elevated privileges, as the '/v1/chat/completions' endpoint is generally exposed to the network to facilitate inference tasks. The impact is significant, as it allows a remote adversary to achieve a DoS state with minimal effort, leveraging the publicly disclosed nature of the exploit to target vulnerable deployments."
}