Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

CVE-2026-115918 — vllm

MEDIUMFix: vllm-project/vllm@cff08b4

CVE-2026-115918 is a medium-severity (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in vllm. A fix is available for vllm — see the affected versions and patch details below.

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

Also known asGHSA-x567-49g5-p4cf
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 28, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs25th percentile — riskier than 25% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-115918 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 396,966 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐍vllm

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

vLLM's /v1/responses endpoint accepts request-level chat_template_kwargs, but does not apply the --trust-request-chat-template gate that protects Chat Completions, render, tokenize, and pooling paths.

When the server is run with the documented default trust_request_chat_template=False and no explicit --chat-template, a Responses request can pass:

{"chat_template_kwargs": {"chat_template": "<attacker Jinja template>"}}

That key is preserved by ChatParams.get_apply_chat_template_kwargs() and then bound as the chat_template parameter to the shared HF renderer. Prior vLLM advisories establish that request-controlled Jinja chat templates can cause CPU/memory exhaustion. This report covers the current-head Responses sibling path missed by the earlier fixes.

Technical Details

The shared OpenAI frontend has a validation helper that rejects request-supplied chat templates unless the trust flag is enabled. It explicitly checks both top-level chat_template and chat_template_kwargs["chat_template"].

Responses is a separate serving path:

  • vllm/entrypoints/openai/responses/protocol.py exposes chat_template_kwargs.
  • ResponsesRequest.build_chat_params() merges request kwargs.
  • OpenAIServingResponses._effective_chat_template_kwargs() uses those kwargs.
  • ChatParams.get_apply_chat_template_kwargs() preserves a request chat_template key when the server chat template is None.
  • vllm/renderers/hf.py unpacks the result into safe_apply_chat_template.

There is no equivalent trust gate in vllm/entrypoints/openai/responses/serving.py.

Impact

An authenticated caller who can submit /v1/responses requests can supply a request-controlled Jinja chat template despite the trust flag being disabled. The expected fixed behavior is the same as Chat Completions: reject chat_template_kwargs["chat_template"] unless the server was started with --trust-request-chat-template.

Suggested Fix

  • Add trust_request_chat_template to OpenAIServingResponses.
  • Pass args.trust_request_chat_template when constructing the Responses serving object.
  • Reject request.chat_template_kwargs["chat_template"] before rendering when trust is false.
  • Keep ordinary kwargs such as enable_thinking working.
  • Add regression tests for default-deny and opt-in-allow behavior on /v1/responses.

Affected Package/Versions

Source sweep found the affected shape in:

  • v0.16.0
  • v0.18.0
  • v0.20.0
  • v0.21.0
  • v0.22.0
  • v0.22.1
  • v0.23.0
  • current checkout 470229c37efaf69c86e8bc97482b0b1ff7551c65
  • current origin/main b3f0a0a0df76dda92ec4b2c9335f77e84adad911

Suggested affected range:

>= 0.16.0, <= 0.23.0

Appendix: Duplicate Research

This is related to, but distinct from:

  • GHSA-6fvq-23cw-5628 / CVE-2025-61620
  • GHSA-69j4-grxj-j64p / CVE-2025-62426

Those advisories establish the security impact of request-controlled Jinja templates and chat_template_kwargs, but they cover older Chat Completions/tokenize implementations. This report covers a current /v1/responses sibling path that still lacks the trust gate.

Local prior submissions this report..029 do not cover this root cause.

This advisory was fixed in MR50300.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIvllm≥ 0.16.0&&< 0.32.00.32.0pip install --upgrade 'vllm==0.32.0'

Affected Products

1 product · 1 configurations
Application
vllmvllm
≥ 0.16.0 && < 0.32.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for vllm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update vllm to 0.32.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-115918 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

## Summary vLLM's `/v1/responses` endpoint accepts request-level `chat_template_kwargs`, but does not apply the `--trust-request-chat-template` gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default `trust_request_chat_template=False` and no explicit `--chat-template`, a Responses request can pass: ```json {"chat_template_kwargs": {"chat_template": "<attacker Jinja template>"}} ``` That key is preserved by `ChatParams.get_apply_chat_template_kwargs()` and then bound as the `chat_template` parameter to the shared HF rende
O3 Security · Impact-Aware SCA

Is CVE-2026-115918 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-115918: vllm — Fixed in 0.32.0