vLLM denial-of-service vulnerability: unbounded chat_template Jinja2 rendering exhausts the rendering thread pool
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
vLLM released a security advisory (GHSA-542m-9234-8gvf, CVE-2026-115911): Jinja2 rendering of chat_template has no wall-clock timeout, output size limit, or loop limit; the rendering thread pool max_workers defaults to 1, and CPython worker threads cannot be interrupted, so a single authenticated request of under 100 bytes can permanently disable all chat-type endpoints such as /v1/chat/completions, /v1/responses, and /tokenize until the process is restarted; the string-multiplication variant kills the API-server process via OOM, and in multi-tenant deployments any tenant can cause cross-tenant denial of service. Versions 0.19.0 and above and before 0.32.0 are affected; fixed in MR50300 and released with 0.32.0.
A single authenticated request of under 100 bytes can, under the default configuration, disable all of vLLM's chat endpoints; teams running self-hosted inference services can use this to check their versions and upgrade to 0.32.0.