The vulnerability allows an attacker to supply an unbounded chat template that is rendered by tokenizer.apply_chat_template() without any wall‑clock time, output size, or iteration limits. Rendering happens in a single‑thread ThreadPoolExecutor, so a template that never terminates or expands without bound can block the executor’s worker. This causes the /v1/responses endpoint to become unresponsive and can consume unlimited memory, potentially crashing the server. The weakness is an uncontrolled resource consumption flaw (CWE-400) and can lead to memory exhaustion (CWE-770) or indeterminate resource usage (CWE-834).

vLLM versions 0.19.0 through 0.32.0 from the vllm-project are affected. Authentication is required to supply a request chat template, or a malicious model repository can provide a template that is compiled by the tokenizer. Harmony models are not vulnerable because they bypass the Jinja2 rendering path.

The CVSS score is 6.5, indicating medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated caller or a malicious model author, and no public exploits have been reported. However, the impact is substantial because the single‑worker thread pool can be stalled or server memory can be exhausted, leading to denial of service.