Junglewise Threat Intelligence

CVE-2026-90878: vLLM Jinja template rendering denial of service

CVE-2026-90878 · Severity: medium · CVSS 4.3 · Published 2026-09-15

Technologies: vLLM Project vllm. Vendors: vLLM Project.

Executive brief

vLLM is a high-performance inference server for large language models that exposes a chat completion API endpoint. The /v1/chat/completions endpoint accepts user-supplied Jinja templates in the chat_template parameter and renders them without any computational resource limits. An attacker can craft a small template (116 bytes) with nested loops that consumes 55 CPU-seconds per request, exhausting the request-handling thread pool and denying service to legitimate requests.

Technical details

The vulnerability is a resource exhaustion flaw in the Rust frontend's Jinja template rendering code (rust/src/chat/src/renderer/hf/template.rs). The TemplateContext::apply() method invokes minijinja's render() without evaluation budgets or timeout limits. While minijinja implements per-range() bounds (~100k elements), nested loops bypass this protection with O(N^depth) complexity. The attack requires no authentication and is remotely triggerable via the /v1/chat/completions POST endpoint. Although vLLM offloads template rendering to a dedicated request runtime (bounded to 32 worker threads), an attacker can monopolize all workers with a few concurrent requests, starving legitimate traffic. vLLM already implements similar resource limits for multimodal decoding (VLLM_MAX_IMAGE_PIXELS, VLLM_MAX_AUDIO_DECODE_DURATION_S) but does not apply them to templates. A fix via pull request is pending.

Affected products

  • vLLM Project vLLM up to 0.27.1

Timeline

  • 2026-09-15: disclosed
  • other: Pull request to fix awaiting acceptance

References