{"id":"PYSEC-2026-4349","details":"vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.","aliases":["CVE-2026-115918","GHSA-x567-49g5-p4cf"],"modified":"2026-10-29T11:00:02.781048532Z","published":"2026-10-26T18:17:39.440Z","references":[{"type":"ADVISORY","url":"https://github.com/vllm-project/vllm/releases/tag/v0.32.0"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/pull/50300"},{"type":"FIX","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-x567-49g5-p4cf"}],"affected":[{"package":{"name":"vllm","ecosystem":"PyPI","purl":"pkg:pypi/vllm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.0"},{"fixed":"0.32.0"}]}],"versions":["0.16.0","0.17.0","0.17.1","0.18.0","0.18.1","0.19.0","0.19.1","0.20.0","0.20.1","0.20.2","0.21.0","0.22.0","0.22.1","0.23.0","0.24.0","0.25.0","0.25.1","0.26.0","0.27.0","0.27.1","0.28.0","0.29.0","0.30.0","0.31.0"],"ecosystem_specific":{},"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-4349.yaml"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}