vLLM CVE-2026-115918

Exploitation requires that the vLLM server was started with the documented default trust_request_chat_template=False AND with no explicit --chat-template (i.e. no server chat template configured), which is what makes ChatParams.get_apply_chat_template_kwargs() preserve the request-supplied chat_template key. The attacker must also be an authenticated caller permitted to reach the /v1/responses endpoint (consistent with PR:L). Limiting factors: this affects only the Responses path (Chat Completions, render, tokenize, and pooling already enforce the trust gate); a deployment that sets a server-side chat template or runs with --trust-request-chat-template handling is not exposed in the same way; and impact is limited to availability (service degradation/denial), with no data disclosure or modification. Affected versions are 0.16.0 up to but not including 0.32.0.

This is a moderate, availability-only denial-of-service issue, not a top-tier emergency. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the advisory: network-reachable, low complexity, but requiring low-level privileges (PR:L) because the attacker must be an authenticated caller able to submit /v1/responses requests, with no confidentiality or integrity impact and high availability impact via CPU/memory exhaustion. The vuln.today decision label is 'this_month' rather than act_now or emergency. No EPSS score was supplied and the issue is not listed in CISA KEV, so there is no public-exploitation signal; exploitation status is 'no public exploit identified at time of analysis.' The GHSA advisory documents the exact triggering payload shape (chat_template_kwargs[chat_template] carrying an attacker Jinja template) but this is a reporter's advisory, not verified working exploit code. The main thing elevating practical risk is that the condition is a documented default (trust_request_chat_template=False with no --chat-template set), so vulnerable deployments are the normal case rather than an edge configuration; the main thing limiting it is the authentication requirement (PR:L) and the fact that impact is confined to availability of the inference server. Net: a real but contained priority - patch to 0.32.0 on a normal maintenance cadence, prioritizing internet-exposed or multi-tenant vLLM endpoints.

An authenticated user of a multi-tenant vLLM server running the default trust_request_chat_template=False with no server-side --chat-template sends a /v1/responses request whose chat_template_kwargs[chat_template] contains a maliciously crafted Jinja template. Because the Responses path never applies the trust gate that protects Chat Completions, the template is bound to the HF renderer and rendered, driving CPU/memory exhaustion that degrades or denies service for other tenants. The advisory describes the payload shape precisely, but the input provides no verified working exploit code.