vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.32.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
vLLM, an open-source engine for serving large language models, is affected through its Responses API endpoint (/v1/responses). An authenticated user can supply their own chat template that bypasses the server's intended trust restrictions, causing the server to consume excessive CPU or memory during template rendering, which can degrade or disrupt service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1/responses endpoint allows an authenticated caller to place an attacker-controlled template in chat_template_kwargs[chat_template] when no server template is configured. ChatParams.get_apply_chat_template_kwargs() preserves that value without enforcing trust_request_chat_template, so the request can bypass the intended trust policy and cause CPU or memory exhaustion through Jinja rendering. This issue is fixed in version 0.32.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- vllm-project vllm
From 0.16.0 · fixed in 0.32.0
- vllmPyPI
From 0.16.0 · fixed in 0.32.0