# CVE-2026-115911: vLLM chat template resource exhaustion denial of service

Source: https://junglewise.ai/threats/cve-2026-115911-vllm-is-an-inference-and-serving-engine-for-large-language  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115911 · Severity: medium · CVSS 6.5 · Published 2026-10-26

vLLM is an inference and serving engine for large language models. Authenticated users can exploit unbounded Jinja2 template rendering to cause denial of service by exhausting server CPU or memory resources, or by blocking chat-style API endpoints indefinitely with nonterminating template renders.

Technologies: [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm), [vLLM Project vllm](https://junglewise.ai/threats/technologies/vllm-project-vllm). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [vLLM Project](https://junglewise.ai/threats/vendors/vllm-project).

## Quick answers

**Is CVE-2026-115911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115911 being exploited in the wild.

**How severe is CVE-2026-115911?** Medium severity, with a CVSS score of 6.5, published 26 October 2026.

**Which products and versions are affected?** vllm (PyPI) >= 0.19.0, < 0.32.0, ECOSYSTEM:introduced=0.19.0,fixed=0.32.0; vLLM Project vllm 0.19.0 to 0.31.0.

**Is there a fix for CVE-2026-115911?** Yes. vllm (PyPI): upgrade to 0.32.0 or later. Until then: Add static AST validation before rendering to reject dangerous template patterns such as excessive range() calls, string multiplication, and deeply nested loops. Configure an async render timeout via VLLM_CHAT_TEMPLATE_RENDER_TIMEOUT environment variable. Restrict chat_template_kwargs in /v1/responses endpoints to prevent user-supplied templates when no server-side --chat-template is configured.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-26"},{"kind":"patched","at":"2026-09-30"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115911 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115911?** Check whether you run vllm (PyPI) or vLLM Project vllm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vllm (PyPI): upgrade to 0.32.0 or later

  ```sh
  pip install "vllm>=0.32.0"
  ```


Add static AST validation before rendering to reject dangerous template patterns such as excessive range() calls, string multiplication, and deeply nested loops. Configure an async render timeout via VLLM_CHAT_TEMPLATE_RENDER_TIMEOUT environment variable. Restrict chat_template_kwargs in /v1/responses endpoints to prevent user-supplied templates when no server-side --chat-template is configured.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-26"},{"kind":"patched","at":"2026-09-30"}]

## Technical details

The vulnerability exists in vLLM's tokenizer.apply_chat_template() function, which renders Jinja2 chat templates without wall-clock timeout, output-size limits, or iteration bounds. Authenticated API callers can supply malicious chat templates directly via /v1/responses, or exploit malicious templates from model repositories. Rendering runs in a ThreadPoolExecutor with a single worker, allowing a nonterminating render to block other chat-template users or exhaust server memory through output expansion.

## Affected products

- vLLM Project vLLM 0.19.0 to 0.31.0

## Identifiers

- CVE-2026-115911
- GHSA-542m-9234-8gvf
- PYSEC-2026-4344

## References

- [https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134](https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134)
- [https://github.com/vllm-project/vllm/pull/50300](https://github.com/vllm-project/vllm/pull/50300)

## Related threats

- [vLLM chat template resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-115918-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://junglewise.ai/threats/cve-2026-115917-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM off-by-one error in tokenizer max_token_id validation](https://junglewise.ai/threats/cve-2026-115916-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM image format validation bypass in media processing](https://junglewise.ai/threats/cve-2026-115915-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM denial of service in DeepSeek-OCR image processing](https://junglewise.ai/threats/cve-2026-115914-vllm-is-an-inference-and-serving-engine-for-large-language)