Executive brief
vLLM is a high-performance inference server for large language models that exposes a chat completion API endpoint. The /v1/chat/completions endpoint accepts user-supplied Jinja templates in the chat_template parameter and renders them without any computational resource limits. An attacker can craft a small template (116 bytes) with nested loops that consumes 55 CPU-seconds per request, exhausting the request-handling thread pool and denying service to legitimate requests.
Technical details
The vulnerability is a resource exhaustion flaw in the Rust frontend's Jinja template rendering code (rust/src/chat/src/renderer/hf/template.rs). The TemplateContext::apply() method invokes minijinja's render() without evaluation budgets or timeout limits. While minijinja implements per-range() bounds (~100k elements), nested loops bypass this protection with O(N^depth) complexity. The attack requires no authentication and is remotely triggerable via the /v1/chat/completions POST endpoint. Although vLLM offloads template rendering to a dedicated request runtime (bounded to 32 worker threads), an attacker can monopolize all workers with a few concurrent requests, starving legitimate traffic. vLLM already implements similar resource limits for multimodal decoding (VLLM_MAX_IMAGE_PIXELS, VLLM_MAX_AUDIO_DECODE_DURATION_S) but does not apply them to templates. A fix via pull request is pending.
Affected products
- vLLM Project vLLM up to 0.27.1
Timeline
- 2026-09-15: disclosed
- other: Pull request to fix awaiting acceptance