CVE-2026-90878 Overview
CVE-2026-90878 is a resource consumption vulnerability [CWE-400] in the vllm-project vLLM inference server, affecting versions up to 0.27.1. The flaw resides in the Jinja template rendering component reached through the /v1/chat/completions endpoint. Attackers can manipulate the chat_template argument to trigger excessive resource consumption on the server. Remote exploitation requires only low-privilege authenticated access to the API. The exploit details have been publicly disclosed, and a pull request to remediate the issue is pending acceptance upstream.
Critical Impact
Authenticated remote attackers can submit crafted chat_template values that cause disproportionate CPU or memory consumption during Jinja rendering, degrading availability of the vLLM inference service.
Affected Products
- vllm-project vLLM versions up to and including 0.27.1
- Deployments exposing the /v1/chat/completions OpenAI-compatible API
- Self-hosted large language model (LLM) serving infrastructure built on vLLM
Discovery Timeline
- 2026-09-15 - CVE-2026-90878 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-90878
Vulnerability Analysis
vLLM exposes an OpenAI-compatible /v1/chat/completions endpoint that accepts a chat_template argument. The value is passed to the Jinja template rendering engine to format chat messages before inference. The endpoint does not sufficiently constrain the complexity of the supplied template. A caller with API access can submit a template that expands or iterates in ways that consume significant server resources during rendering. The result is degraded service quality or a full denial of service for other tenants of the same inference server. The behavior is classified under Uncontrolled Resource Consumption [CWE-400].
Root Cause
The root cause is missing input constraints on user-controlled Jinja templates. Jinja allows loops, nested structures, and macro expansion that can produce output or intermediate state far larger than the input. Without limits on template size, execution time, or output length, the rendering step becomes an attacker-controlled workload.
Attack Vector
Exploitation occurs over the network against an exposed vLLM API. The attacker authenticates with low-privilege credentials, then issues a POST request to /v1/chat/completions containing a crafted chat_template. Repeated or concurrent requests amplify the impact against the target inference host. No user interaction is required.
No verified proof-of-concept code has been published to a vetted repository. Technical detail is available in the upstream GitHub Issue #52025 and the pending GitHub Pull Request #52163.
Detection Methods for CVE-2026-90878
Indicators of Compromise
- Sustained spikes in CPU or memory usage on vLLM worker processes correlated with /v1/chat/completions requests
- API request bodies containing unusually large or deeply nested chat_template values
- Increased request latency or timeouts affecting other tenants of the same inference endpoint
Detection Strategies
- Log and inspect the size and structure of the chat_template field on inbound requests to /v1/chat/completions
- Alert on API clients whose requests correlate with abnormal resource consumption on the inference host
- Baseline normal template payload sizes and flag statistical outliers
Monitoring Recommendations
- Collect process-level CPU, memory, and request duration metrics from vLLM workers into a centralized data lake
- Correlate API access logs with host telemetry to identify low-privileged accounts issuing expensive requests
- Track EPSS movement for CVE-2026-90878; the current EPSS probability is 0.303%
How to Mitigate CVE-2026-90878
Immediate Actions Required
- Restrict /v1/chat/completions access to trusted networks and authenticated clients only
- Disable or reject client-supplied chat_template values where operationally feasible; enforce server-side templates
- Apply per-client rate limits and request size limits at an API gateway or reverse proxy
- Monitor the upstream fix in GitHub Pull Request #52163 and plan a maintenance window for deployment
Patch Information
At publication, the fix for CVE-2026-90878 is a pending pull request in the upstream repository and has not been accepted into a released version. Track progress via the vLLM GitHub repository, GitHub Issue #52025, and the VulDB entry for CVE-2026-90878. Upgrade to a released version that incorporates the merged fix as soon as one is available.
Workarounds
- Enforce a maximum byte size on request bodies at the reverse proxy or ingress layer
- Strip or override the chat_template field in an API gateway policy before requests reach vLLM
- Run vLLM workers with resource limits using cgroups or container quotas to contain a single tenant's impact
- Require strong authentication and network segmentation so only vetted internal services can call the endpoint
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
