PT-2025-47650 · Vllm · Vllm

Published 2025-11-20 · Updated 2025-12-04 · CVE-2025-62426

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions vLLM versions 0.5.5 through 0.11.0

Description vLLM is an inference and serving engine for large language models (LLMs). The /v1/chat/completions and /tokenize API endpoints accept a chat template kwargs request parameter that is not properly validated against the chat template. This allows a malicious actor to potentially block processing of the API server for an extended period, impacting all other requests. The chat template kwargs parameter is used in the code before validation.

Recommendations Update vLLM to version 0.11.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-14680

CVE-2025-62426

GHSA-69J4-GRXJ-J64P

Affected Products

Vllm

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62426.json · Exploit
• https://github.com/vllm-project/vllm/commit/3ada34f9cb4d1af763fdfa3b481862a93eb6bd2b · Patch
• https://github.com/vllm-project/vllm/security/advisories/GHSA-69j4-grxj-j64p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62426 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14680 · Security Note
• https://osv.dev/vulnerability/GHSA-69j4-grxj-j64p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62426 · Security Note
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/openai/serving_engine.py#L809-L814 · Note
• https://github.com/vllm-project/vllm/pull/27205 · Note
• https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/chat_utils.py#L1602-L1610 · Note
• https://reddit.com/r/VulnMatter/comments/1p5s47k/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post
• https://t.me/CVEtracker/37889 · Telegram Post
• https://t.me/cveNotify/143523 · Telegram Post
• https://twitter.com/CVEnew/status/1991729599424909363 · Twitter Post