Description
A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vLLM | 0.27.0, 0.27.1 | — |
Advisories 1
- WID-SEC-2026-3357 vllm: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 14, 2026
References
- VDB-403472 | vllm-project vLLM Jinja Template Rendering completions resource consumption vdb-entry technical-description
- VDB-403472 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-90878 | CVE Analysis and Report third-party-advisory
- Submit #927901 | vLLM Project vLLM 0.27.1 Asymmetric Resource Consumption third-party-advisory
- https://github.com/vllm-project/vllm/issues/52025 exploit issue-tracking
- https://github.com/vllm-project/vllm/pull/52163 issue-tracking patch
- https://github.com/vllm-project/vllm/ product