UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62426

DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

Severity
Medium 6.5
Published
20 Nov 2025
Last changed
19 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.11.1
Also known as
GHSA-69j4-grxj-j64p
Sources
NVD, Project advisories (GitHub)

Description

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_template_kwargs request parameter that is used in the code before it is properly validated against the chat template. With the right chat_template_kwargs parameters, it is possible to block processing of the API server for…

Affected software

SoftwareAffected versions
vLLMServers and applications · cpe:a:vllm:vllm
  • From 0.5.5 before 0.11.1
  • Version 0.11.1-rc0
  • Version 0.11.1-rc1
vLLMServers and applications · github:vllm-project/vllm
  • From 0.5.5 before 0.11.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62426
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62426
  • GitHub Advisory Database https://github.com/advisories/GHSA-69j4-grxj-j64p
  • github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-69j4-grxj-j64p