Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90878

vllm-project vLLM Jinja Template Rendering completions resource consumption

CVSS 4.0 5.3 MEDIUMCVSS 3.1 4.3 MEDIUMCVSS 3.0 4.3 MEDIUMCVSS 2.0 4.0 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90878

Published

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90878

Published

vLLM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "vllm-project",
                    "product": "vLLM",
                    "versions": [
                        {
                            "version": "0.27.0",
                            "status": "affected"
                        },
                        {
                            "version": "0.27.1",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Jinja Template Rendering"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON