Is CVE-2026-115911 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115911 being exploited in the wild.

How severe is CVE-2026-115911?

Medium severity, with a CVSS score of 6.5, published 26 October 2026.

Which products and versions are affected?

vllm (PyPI) >= 0.19.0, < 0.32.0, ECOSYSTEM:introduced=0.19.0,fixed=0.32.0; vLLM Project vllm 0.19.0 to 0.31.0.

How is CVE-2026-115911 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115911?

Check whether you run vllm (PyPI) or vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115911: vLLM chat template resource exhaustion denial of service

Q: Is there a fix for CVE-2026-115911?

Yes. vllm (PyPI): upgrade to 0.32.0 or later. Until then: Add static AST validation before rendering to reject dangerous template patterns such as excessive range() calls, string multiplication, and deeply nested loops. Configure an async render timeout via VLLM_CHAT_TEMPLATE_RENDER_TIMEOUT environment variable. Restrict chat_template_kwargs in /v1/responses endpoints to prevent user-supplied templates when no server-side --chat-template is configured. [{"kind":"disclosed","at":"2026-10-26"},{"kind":"patched","at":"2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-115911 · Severity: medium · CVSS 6.5 · Published 2026-10-26

vLLM is an inference and serving engine for large language models. Authenticated users can exploit unbounded Jinja2 template rendering to cause denial of service by exhausting server CPU or memory resources, or by blocking chat-style API endpoints indefinitely with nonterminating template renders.

Technologies: vllm (PyPI), vLLM Project vllm. Vendors: PyPI, vLLM Project.

Quick answers

Is CVE-2026-115911 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115911 being exploited in the wild.
How severe is CVE-2026-115911?: Medium severity, with a CVSS score of 6.5, published 26 October 2026.
Which products and versions are affected?: vllm (PyPI) >= 0.19.0, < 0.32.0, ECOSYSTEM:introduced=0.19.0,fixed=0.32.0; vLLM Project vllm 0.19.0 to 0.31.0.
Is there a fix for CVE-2026-115911?: Yes. vllm (PyPI): upgrade to 0.32.0 or later. Until then: Add static AST validation before rendering to reject dangerous template patterns such as excessive range() calls, string multiplication, and deeply nested loops. Configure an async render timeout via VLLM_CHAT_TEMPLATE_RENDER_TIMEOUT environment variable. Restrict chat_template_kwargs in /v1/responses endpoints to prevent user-supplied templates when no server-side --chat-template is configured.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-26"},{"kind":"patched","at":"2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115911 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115911?: Check whether you run vllm (PyPI) or vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

vllm (PyPI): upgrade to 0.32.0 or later
```
pip install "vllm>=0.32.0"
```

Add static AST validation before rendering to reject dangerous template patterns such as excessive range() calls, string multiplication, and deeply nested loops. Configure an async render timeout via VLLM_CHAT_TEMPLATE_RENDER_TIMEOUT environment variable. Restrict chat_template_kwargs in /v1/responses endpoints to prevent user-supplied templates when no server-side --chat-template is configured.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-26"},{"kind":"patched","at":"2026-09-30"}]

Technical details

The vulnerability exists in vLLM's tokenizer.apply_chat_template() function, which renders Jinja2 chat templates without wall-clock timeout, output-size limits, or iteration bounds. Authenticated API callers can supply malicious chat templates directly via /v1/responses, or exploit malicious templates from model repositories. Rendering runs in a ThreadPoolExecutor with a single worker, allowing a nonterminating render to block other chat-template users or exhaust server memory through output expansion.

Affected products

vLLM Project vLLM 0.19.0 to 0.31.0

Identifiers

CVE-2026-115911
GHSA-542m-9234-8gvf
PYSEC-2026-4344

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.