A tokenizer chat template containing an unbounded Jinja loop occupied the vLLM shared rendering worker while subsequent inference requests waited. The attacker needed to supply a model tokenizer configuration or otherwise control a reachable chat-template input path, not merely write ordinary prompt text. A small template could create an indefinitely…
Inspect the ClaimsCase · DiggingBeagle record
vLLM unbounded Jinja chat templates could monopolize a shared renderer
A tokenizer chat template containing an unbounded Jinja loop occupied the vLLM shared rendering worker while subsequent inference requests waited. A small template could create an indefinitely stalled renderer or large computation and deny service to other model users.
Scope
The attacker needed to supply a model tokenizer configuration or otherwise control a reachable chat-template input path, not merely write ordinary prompt text. The proof shows an availability failure, not arbitrary Python execution and not a documented production outage.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: The attack surface includes model tokenizer configuration as well as request-time templates where those are permitted.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-VLLM-JINJA-CPU-1 · CLM-ENRICH-20261029-36 · vLLM Jinja renderer CPU exhaustion, CVE-2026-115911
At a glance
A small template could create an indefinitely stalled renderer or large computation and deny service to other model users.
Read the implicationsThe proof shows an availability failure, not arbitrary Python execution and not a documented production outage.
Limits and uncertaintyFull account
A tokenizer chat template containing an unbounded Jinja loop occupied the vLLM shared rendering worker while subsequent inference requests waited.
The attacker needed to supply a model tokenizer configuration or otherwise control a reachable chat-template input path, not merely write ordinary prompt text. A small template could create an indefinitely stalled renderer or large computation and deny service to other model users.
The proof shows an availability failure, not arbitrary Python execution and not a documented production outage. Upgrade vLLM to 0.32.0 and enforce template execution budgets and source trust before model configuration loads.
Evidence interpretation and control boundary. The attack surface includes model tokenizer configuration as well as request-time templates where those are permitted. A tiny Jinja loop can monopolize a shared rendering worker even though it performs no privileged shell command; subsequent inference users then queue behind the blocked thread. A template source check must be combined with execution limits and cancellation so that model configuration cannot silently become an unbounded shared resource.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-36The vLLM advisory describes a small unbounded Jinja chat template that stalls a shared renderer worker and blocks later requests, under an attacker-controlled template input path.supported
Basis: reported finding
- supportsvLLM Jinja renderer CPU exhaustion, CVE-2026-115911primary disclosure
GHSA-542m-9234-8gvf: Jinja2 rendering worker, crafted template and patch
CLM-CP23-VLLM-JINJA-CPU-1A tokenizer chat template containing an unbounded Jinja loop occupied the vLLM shared rendering worker while subsequent inference requests waited. The attacker needed to supply a model tokenizer configuration or otherwise control a reachable chat-template input path, not merely write ordinary prompt text. A small template could create an indefinitely stalled renderer or large computation and deny service to other model users.supported
Basis: reported finding
- supportsvLLM Jinja renderer CPU exhaustion, CVE-2026-115911primary disclosure
GHSA-542m-9234-8gvf: Jinja2 rendering worker, crafted template and patch
Implications
A small template could create an indefinitely stalled renderer or large computation and deny service to other model users.
Controls and mitigations
- Upgrade vLLM to 0.32.0 and enforce template execution budgets and source trust before model configuration loads.
Unknowns and contradictions
- The proof shows an availability failure, not arbitrary Python execution and not a documented production outage.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202