{"data":{"id":"aa27593b-546b-4d27-854a-7bd3ba2b9a16","title":"CVE-2025-62426: vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the…","summary":"CVE-2025-62426 affects vLLM, an inference and serving engine for large language models, from version 0.5.5 to before 0.11.1. The /v1/chat/completions and /tokenize endpoints use the chat_template_kwargs request parameter in code before validating it against the chat template. Crafted values of that parameter can block the API server for long periods, delaying all other requests.","solution":"This issue has been patched in version 0.11.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62426","publishedAt":"2025-11-21T07:15:43.570Z","cveId":"CVE-2025-62426","cweIds":["CWE-770"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.5.5, < 0.11.1 (fixed: 0.11.1)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM denial of service via chat_template_kwargs in chat endpoints","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00538,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-69j4-grxj-j64p"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:58.347Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-11-19T01:55:10.996Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:42:30.137Z","capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.11.1","matchedVersion":"0.11.1","fixReleasedAt":"2025-11-19T01:55:10.996Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:42:29.987Z"}]}}