vLLM: Responses API bypasses the trust_request_chat_template gate when handling chat_template_kwargs
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
vLLM security advisory (GHSA-x567-49g5-p4cf / CVE-2026-115918): the /v1/responses endpoint accepts request-level chat_template_kwargs but lacks the --trust-request-chat-template gate that protects the Chat Completions, render, tokenize, and pooling paths. When the server is started with the default trust_request_chat_template=False and without an explicit --chat-template, an authenticated caller can pass a controlled Jinja chat template through a Responses request, and that template is bound to the shared HF renderer; previous advisories have confirmed that request-controllable Jinja templates can cause CPU/memory exhaustion. Affected versions are 0.16.0 and above, before 0.32.0; it has been fixed in 0.32.0 (MR50300).
Teams running their own vLLM services can use this to check whether the Responses endpoint exposes template parameters that should be denied by default, and confirm upgrading to 0.32.0.