What happened
A batch of vLLM 0.32.0 fixes closes request-driven failure modes in the multimodal and token paths: attacker-controlled chat templates compiled/rendered by the tokenizer, an off-by-one max_token_id that lets pre-tokenized prompt IDs equal to the vocab size pass validation, a Phi-4 audio encoder that uses eager attention by default (single long audio clip exhausts it), a DeepSeek-OCR path that divides by a zero-sum normalized pixel aggregate, and the /v1/responses template injection.
Why it matters
These are low-friction denial-of-service and out-of-bounds access paths in a widely deployed LLM serving engine: each is triggered by a single crafted API request and can take a shared inference server down or corrupt GPU tensor access, so a remote caller (or a prompt-injected agent) can disrupt or destabilize the serving tier.
Attack vector
A remote client submits a crafted request that reaches client-controlled template compilation/rendering, an out-of-vocabulary/pre-tokenized prompt token id, or a pathological multimodal media payload (long audio clip, zero-sum-normalized OCR image, oversized frame count), causing the engine to crash, the inference work to exhaust memory, or an out-of-bounds column access on GPU.
Affected systems
vLLM from ~0.11.1 / 0.16.0 / 0.19.0 until 0.32.0. Specifically CVE-2026-115911 (request chat template injection), CVE-2026-115913 (Phi-4 audio encoder eager-attention DoS), CVE-2026-115914 (DeepSeek-OCR/unlimited-OCR normalized-pixel-sum-to-zero DoS), CVE-2026-115916 (off-by-one max_token_id OOB), CVE-2026-115918 (/v1/responses attacker-controlled chat template).
Mitigation
Upgrade to vLLM 0.32.0 or later. Where upgrading is delayed, put a proxy in front of the endpoints and restrict chat-template/token-id/multimodal inputs; configure server-side --chat-template so clients cannot supply one.