ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-115918

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115918. EPSS is 0.35%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.35%
Remediation
Version ranges on file
Affected products
pip vllm

## Summary vLLM's endpoint accepts request-level , but does not apply the gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default and no explicit , a Responses request can pass: That key is preserved by and then bound as the parameter to the shared HF renderer. Prior vLLM advisories establish that request-controlled Jinja chat templates can cause CPU/memory exhaustion. This report covers the current-head Responses sibling path missed by the earlier fixes. ## Technical Details The shared OpenAI frontend has a validation helper that rejects request-supplied chat templates unless the trust flag is enabled. It explicitly checks both top-level and . Responses is a separate serving path: - exposes . - merges request kwargs. - uses those kwargs. - preserves a request key when the server chat template is . - unpacks the result into . There is no equivalent trust gate in . ## Impact An authenticated caller who can submit requests can supply a request-controlled Jinja chat template despite the trust flag being disabled. The expected fixed behavior is the same as Chat Completions: reject unless the server was started with . ## Suggested Fix - Add to . - Pass when constructing the Responses serving object. - Reject before rendering when trust is false. - Keep ordinary kwargs such as working. - Add regression tests for default-deny and opt-in-allow behavior on . ## Affected Package/Versions Source sweep found the affected shape in: - - - - - - - - current checkout - current Suggested affected range: ## Appendix: Duplicate Research This is related to, but distinct from: - / - / Those advisories establish the security impact of request-controlled Jinja templates and , but they cover older Chat Completions/tokenize implementations. This report covers a current sibling path that still lacks the trust gate. Local prior submissions this report..029 do not cover this root cause. This advisory was fixed in [MR50300](ht

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip vllm>= 0.16.0, < 0.32.0

How to fix CVE-2026-115918

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115918. EPSS is 0.35%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with >= 0.16.0, < 0.32.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-770: Allocation of Resources Without Limits or Throttling; CWE-94: Code Injection. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · Red Hat Security Data

    Detected

    vllm: vLLM: Denial of service via untrusted chat template processing

  2. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ## Summary vLLM's endpoint accepts request-level , but does not apply the gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default and no explicit , a Responses request can pass: That key is preserved by and then bound as the parameter to the shared HF renderer. Prior vLLM advisories establish that request-controlled Jinja chat te

Sources

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 7, 2026
  • GitHub Advisory DatabaseOct 29, 2026
  • CVE.orgOct 27, 2026
  • Red Hat Security DataOct 27, 2026