{"id":"ghsa-ghsa-542m-9234-8gvf","seq":2056931,"kind":"advisory","title":"vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool","url":"https://github.com/advisories/GHSA-542m-9234-8gvf","permalink":"https://vulnpulse.app/items/ghsa-ghsa-542m-9234-8gvf","summary":"影響: pip:vllm >= 0.19.0, < 0.32.0 → 0.32.0\nvLLM renders chat templates by passing the resolved Jinja2 source to tokenizer.apply_chat_template(), which compiles and .render()s it in an ImmutableSandboxedEnvironment. The sandbox prevents code-execution escapes but imposes no wall-clock timeout, no output-size cap, and no nested-loop or binop limit. The render runs in a ThreadPoolExecutor whose max_workers defaults to 1, and CPython worker threads cannot be interrupted. An authenticated API client (or a malicious model repo loaded with tru…","severity":"medium","techs":["python"],"cves":["CVE-2026-115911"],"tags":["GHSA-542m-9234-8gvf","vllm"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:14:52.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}