CVE-2026-90878

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90878

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90878.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90878

Published

2026-09-15T04:15:11Z

Modified

2026-09-17T03:30:19Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

vllm-project vLLM Jinja Template Rendering completions resource consumption

Details

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat_template causes resource consumption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-400",
        "CWE-404"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90878.json"
}

References

Affected packages

Git / github.com/vllm-project/vllm

Affected ranges

Type

GIT

Repo

https://github.com/vllm-project/vllm

Events

Introduced

4bdc8a788d2e2ce9165d552b3d4d8b72604626bf

Last Affected

6e448d0ea9bf3d88d898b65449ca6dc2aec170ac

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.27.0"
        },
        {
            "last_affected": "0.27.0"
        },
        {
            "introduced": "0.27.1"
        },
        {
            "last_affected": "0.27.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.27.0

0.27.1

v0.*

v0.27.0

v0.27.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90878.json"