---
id: CVE-2026-115918
aliases:
  - GHSA-x567-49g5-p4cf
  - PYSEC-2026-4349
title: >-
  vLLM: Responses API bypasses trust_request_chat_template for
  chat_template_kwargs
summary: >-
  vLLM: Responses API bypasses trust_request_chat_template for
  chat_template_kwargs
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: vllm
product: vllm
ecosystem: pip
affected:
  - 'vllm >= 0.16.0, < 0.32.0'
patched:
  - vllm 0.32.0
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T11:10:53.778002992Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-x567-49g5-p4cf'
references:
  - url: >-
      https://github.com/vllm-project/vllm/security/advisories/GHSA-x567-49g5-p4cf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115918'
  - url: 'https://github.com/vllm-project/vllm/pull/50300'
  - url: >-
      https://github.com/vllm-project/vllm/commit/cff08b461e086523cee8bba5bd3c66d302625134
  - url: 'https://github.com/vllm-project/vllm'
  - url: 'https://github.com/vllm-project/vllm/releases/tag/v0.32.0'
  - url: 'https://github.com/advisories/GHSA-x567-49g5-p4cf'
tags:
  - osv
  - pip
  - ghsa
  - cve.org
epss: 0.0035
epssPercentile: 0.28639
cwe:
  - CWE-400
  - CWE-770
ingestedAt: '2026-10-26T17:33:33.054Z'
---

## Overview

## Summary

vLLM's `/v1/responses` endpoint accepts request-level `chat_template_kwargs`, but does not apply the `--trust-request-chat-template` gate that protects Chat Completions, render, tokenize, and pooling paths.

When the server is run with the documented default `trust_request_chat_template=False` and no explicit `--chat-template`, a Responses request can pass:

```json
{"chat_template_kwargs": {"chat_template": "<attacker Jinja template>"}}
```

That key is preserved by `ChatParams.get_apply_chat_template_kwargs()` and then bound as the `chat_template` parameter to the shared HF renderer. Prior vLLM advisories establish that request-controlled Jinja chat templates can cause CPU/memory exhaustion. This report covers the current-head Responses sibling path missed by the earlier fixes.

## Technical Details

The shared OpenAI frontend has a validation helper that rejects request-supplied chat templates unless the trust flag is enabled. It explicitly checks both top-level `chat_template` and `chat_template_kwargs["chat_template"]`.

Responses is a separate serving path:

- `vllm/entrypoints/openai/responses/protocol.py` exposes `chat_template_kwargs`.
- `ResponsesRequest.build_chat_params()` merges request kwargs.
- `OpenAIServingResponses._effective_chat_template_kwargs()` uses those kwargs.
- `ChatParams.get_apply_chat_template_kwargs()` preserves a request `chat_template` key when the server chat template is `None`.
- `vllm/renderers/hf.py` unpacks the result into `safe_apply_chat_template`.

There is no equivalent trust gate in `vllm/entrypoints/openai/responses/serving.py`.

## Impact

An authenticated caller who can submit `/v1/responses` requests can supply a request-controlled Jinja chat template despite the trust flag being disabled. The expected fixed behavior is the same as Chat Completions: reject `chat_template_kwargs["chat_template"]` unless the server was started with `--trust-request-chat-template`.

## Suggested Fix

- Add `trust_request_chat_template` to `OpenAIServingResponses`.
- Pass `args.trust_request_chat_template` when constructing the Responses serving object.
- Reject `request.chat_template_kwargs["chat_template"]` before rendering when trust is false.
- Keep ordinary kwargs such as `enable_thinking` working.
- Add regression tests for default-deny and opt-in-allow behavior on `/v1/responses`.

## Affected Package/Versions

Source sweep found the affected shape in:

- `v0.16.0`
- `v0.18.0`
- `v0.20.0`
- `v0.21.0`
- `v0.22.0`
- `v0.22.1`
- `v0.23.0`
- current checkout `470229c37efaf69c86e8bc97482b0b1ff7551c65`
- current `origin/main` `b3f0a0a0df76dda92ec4b2c9335f77e84adad911`

Suggested affected range:

```text
>= 0.16.0, <= 0.23.0
```

## Appendix: Duplicate Research

This is related to, but distinct from:

- `GHSA-6fvq-23cw-5628` / `CVE-2025-61620`
- `GHSA-69j4-grxj-j64p` / `CVE-2025-62426`

Those advisories establish the security impact of request-controlled Jinja templates and `chat_template_kwargs`, but they cover older Chat Completions/tokenize implementations. This report covers a current `/v1/responses` sibling path that still lacks the trust gate.

Local prior submissions this report..029 do not cover this root cause.

This advisory was fixed in [MR50300](https://github.com/vllm-project/vllm/pull/50300).

## Affected packages

- `vllm >= 0.16.0, < 0.32.0`

## Remediation

Upgrade to a patched release:

- `vllm 0.32.0`