Vulnerability · Published Sep 15, 2026 · Assigned by VulDB

CVE-2026-90878vllm-project vLLM Jinja Template Rendering completions resource consumption

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in vLLM from vllm-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
vllm-project	vLLM	0.27.00.27.1

Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References

VDB-403472 | vllm-project vLLM Jinja Template Rendering completions resource consumption vdb-entry, technical-description
VDB-403472 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-90878 | CVE Analysis and Report third-party-advisory
Submit #927901 | vLLM Project vLLM 0.27.1 Asymmetric Resource Consumption third-party-advisory
https://github.com/vllm-project/vllm/issues/52025 exploit, issue-tracking
https://github.com/vllm-project/vllm/pull/52163 issue-tracking, patch
https://github.com/vllm-project/vllm/ product