vLLM, an inference and serving engine for large language models, contains a flaw in the /v1/responses endpoint that allows an authenticated caller to supply a malicious template through chat_template_kwargs[chat_template] when no server template is configured. The application fails to enforce the trust_request_chat_template policy, enabling the attacker‑controlled template to be rendered by Jinja. This is a resource exhaustion vulnerability (CWE-400) involving excessive allocation (CWE-770) that can lead to uncontrolled CPU or memory consumption, effectively causing a denial of service on the host running the vLLM service.

vLLM engines with versions between 0.16.0 and 0.31.x deployed by organizations that rely on the /v1/responses API. The affected product is provided by the vllm-project under the vllm namespace.

The CVSS score of 6.5 indicates moderate severity. No EPSS data is available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires an authenticated request to the /v1/responses endpoint, an attacker must first obtain valid credentials or access token. Once authenticated, the attacker can supply the malicious template, potentially exhausting server resources. The absence of a restriction on trusted templates means that the attack can be performed by any authenticated user who has permission to use the endpoint.