CVE-2026-90878: vLLM: chat_template abuse causes resource exhaustion

MEDIUMPoC AVAILABLECISA: TRACK*

Published September 15, 2026

CISO Take

CVE-2026-90878 lets an authenticated remote user send a crafted chat_template argument to vLLM's /v1/chat/completions endpoint and force expensive Jinja template rendering, tying up the inference server and degrading availability. The impact is limited to availability, with no confidentiality or integrity effect, which is why the CVSS score is only 4.3. Even so, a public proof-of-concept exists, the attack is low complexity, and CISA's SSVC decision is TRACK*, so it deserves attention on any internet-facing or multi-tenant vLLM deployment. EPSS is low at 0.53% (around the 57th percentile) and the CVE is not in CISA KEV, so mass exploitation is unlikely right now. The fix is a pull request (#52163) that had not yet been accepted at publication, so check the vLLM repository for a patched release beyond 0.27.1. Until then, stop clients from supplying their own chat_template and put rate limits and request timeouts in front of the endpoint.

Sources:NVDEPSSATLASGitHub (vllm-project/vllm issue and pull request)VulDB

What is the risk?

Medium. The attack is network-reachable, low complexity, and needs only low privileges (a valid API key or access to the endpoint), with no user interaction. The impact is availability only (A:L). A public PoC raises the chance of opportunistic abuse, but EPSS is low and there is no KEV listing or Nuclei template. Exposure is highest where vLLM is shared across tenants or exposed to untrusted API clients, because one client can degrade service for everyone. The fix was pending at disclosure.

How does the attack unfold?

Initial Access

The attacker authenticates with a low-privilege key or reaches an exposed vLLM /v1/chat/completions endpoint.

AML.T0040

Exploitation

The attacker sends a request with a crafted chat_template argument that makes Jinja rendering consume excessive resources.

AML.T0034.001

Impact

The inference server slows or stalls, denying service to legitimate users and downstream AI applications.

AML.T0029

Initial Access

The attacker authenticates with a low-privilege key or reaches an exposed vLLM /v1/chat/completions endpoint.

AML.T0040

Exploitation

The attacker sends a request with a crafted chat_template argument that makes Jinja rendering consume excessive resources.

AML.T0034.001

Impact

The inference server slows or stalls, denying service to legitimate users and downstream AI applications.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
96.0K94 dependentsPushed 5d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Track vllm-project/vllm PR #52163 and issue #52025, and upgrade to the first release that includes the fix. 2) Until then, reject or strip the chat_template field from client requests at an API gateway or reverse proxy, and rely on the server-side template configured at launch. 3) Enforce authentication, per-key rate limits, request size limits and timeouts in front of /v1/chat/completions. 4) Do not expose vLLM directly to the internet or untrusted tenants. 5) Detect abuse by alerting on requests that contain chat_template, on unusually long request-processing times, and on CPU or memory spikes on inference nodes. 6) Set resource limits and health-based restarts on vLLM containers.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0040- AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and system availability

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-90878?

Is CVE-2026-90878 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-90878, increasing the risk of exploitation.

How to fix CVE-2026-90878?

1) Track vllm-project/vllm PR #52163 and issue #52025, and upgrade to the first release that includes the fix. 2) Until then, reject or strip the chat_template field from client requests at an API gateway or reverse proxy, and rely on the server-side template configured at launch. 3) Enforce authentication, per-key rate limits, request size limits and timeouts in front of /v1/chat/completions. 4) Do not expose vLLM directly to the internet or untrusted tenants. 5) Detect abuse by alerting on requests that contain chat_template, on unusually long request-processing times, and on CPU or memory spikes on inference nodes. 6) Set resource limits and health-based restarts on vLLM containers.

What systems are affected by CVE-2026-90878?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference APIs, multi-tenant inference gateways, RAG pipelines, agent frameworks.

What is the CVSS score for CVE-2026-90878?

CVE-2026-90878 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference APIsmulti-tenant inference gatewaysRAG pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0040AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Exploitation Scenario

An attacker with a low-privilege API key for a shared vLLM endpoint sends repeated POST requests to /v1/chat/completions with a chat_template argument containing a pathological Jinja construct, such as deeply nested loops or huge string expansions. Each request consumes disproportionate CPU or memory in the rendering step. A handful of concurrent requests saturates the server, so legitimate inference calls time out and downstream applications fail until the process is restarted.

Weaknesses (CWE)

CWE-400Uncontrolled Resource ConsumptionPrimary CWE-404Improper Resource Shutdown or ReleasePrimary CWE-400Uncontrolled Resource Consumption CWE-404Improper Resource Shutdown or Release

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.