Threats tagged 'pysec-2026-4344'

vLLM versions from 0.19.0 up to but not including 0.32.0 contain a vulnerability where authenticated users can supply a request chat template if no server-side template is configured. This allows a malicious template to be compiled and rendered without execution limits, potentially causing denial of service by blocking response handling or exhausting server memory. Harmony models are not affected. The issue is fixed in version 0.32.0.