PT-2025-47650 · Vllm · Vllm

CVE-2025-62426 · Published 2025-11-20 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions vLLM versions 0.5.5 through 0.11.0

Description vLLM is an inference and serving engine for large language models (LLMs). The /v1/chat/completions and /tokenize API endpoints accept a chat template kwargs request parameter that is not properly validated against the chat template. This allows a malicious actor to potentially block processing of the API server for an extended period, impacting all other requests. The chat template kwargs parameter is used in the code before validation.

Recommendations Update vLLM to version 0.11.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-14680

CVE-2025-62426

GHSA-69J4-GRXJ-J64P

PYSEC-2026-2012

Affected Products

Vllm

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62426.json · Exploit
• https://github.com/vllm-project/vllm/security/advisories/GHSA-69j4-grxj-j64p · Vendor Advisory
• https://github.com/vllm-project/vllm/commit/3ada34f9cb4d1af763fdfa3b481862a93eb6bd2b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62426 · Security Note
• https://bdu.fstec.ru/vul/2025-14680 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62426 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-69j4-grxj-j64p · Vendor Advisory
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/chat_utils.py#L1602-L1610 · Note
• https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/openai/serving_engine.py#L809-L814 · Note
• https://github.com/vllm-project/vllm/pull/27205 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2012.yaml · Note
• https://twitter.com/VulmonFeeds/status/1991742438902259993 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p2foxr/resumen_diario_de_vulnerabilidades_20112025 · Reddit Post