{"schemaVersion":3,"id":"CVE-2025-61620","aliases":["GHSA-6fvq-23cw-5628","PYSEC-2026-2013","CGA-8cx2-2wcc-fqg9","CGA-r5v8-h3c6-8xwc","CGA-rwf7-gg96-c3gg","CGA-wqg3-mv26-m8hj","CGA-xwxp-mgwr-7r8m"],"status":"published","duplicateOf":null,"title":null,"description":"vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server\n\n### Summary\n\nA resource-exhaustion (denial-of-service) vulnerability exists in multiple endpoints of the OpenAI-Compatible Server due to the ability to specify Jinja templates via the `chat_template` and `chat_template_kwargs` parameters. If an attacker can supply these parameters to the API, they can cause a service outage by exhausting CPU and/or memory resources.\n\n### Details\n\nWhen using an LLM as a chat model, the conversation history must be rendered into a text input for the model. In `hf/transformer`, this rendering is performed using a Jinja template. The OpenAI-Compatible Server launched by vllm serve exposes a `chat_template` parameter that lets users specify that template. In addition, the server accepts a `chat_template_kwargs` parameter to pass extra keyword arguments to the rendering function.\n\nBecause Jinja templates support programming-language-like constructs (loops, nested iterations, etc.), a crafted template can consume extremely large amounts of CPU and memory and thereby trigger a denial-of-service condition.\n\nImportantly, simply forbidding the `chat_template` parameter does not fully mitigate the issue. The implementation constructs a dictionary of keyword arguments for `apply_hf_chat_template` and then updates that dictionary with the user-supplied `chat_template_kwargs` via `dict.update`. Since `dict.update` can overwrite existing keys, an attacker can place a `chat_template` key inside `chat_template_kwargs` to replace the template that will be used by `apply_hf_chat_template`.\n\n\n```python\n# vllm/entrypoints/openai/serving_engine.py#L794-L816\n_chat_template_kwargs: dict[str, Any] = dict(\n    chat_template=chat_template,\n    add_generation_prompt=add_generation_prompt,\n    continue_final_message=continue_final_message,\n    tools=tool_dicts,\n    documents=documents,\n)\n_chat_template_kwargs.update(chat_template_kwargs or {})\n\nrequest_prompt: Union[str, list[int]]\nif isinstance(tokenizer, MistralTokenizer):\n    ...\nelse:\n    request_prompt = apply_hf_chat_template(\n        tokenizer=tokenizer,\n        conversation=conversation,\n        model_config=model_config,\n        **_chat_template_kwargs,\n    )\n```\n\n### Impact\n\nIf an OpenAI-Compatible Server exposes endpoints that accept `chat_template` or `chat_template_kwargs` from untrusted clients, an attacker can submit a malicious Jinja template (directly or by overriding `chat_template` inside `chat_template_kwargs`) that consumes excessive CPU and/or memory. This can result in a resource-exhaustion denial-of-service that renders the server unresponsive to legitimate requests.\n\n### Fixes\n\n* https://github.com/vllm-project/vllm/pull/25794","dates":{"published":"2026-07-07T16:03:06.869Z","modified":"2026-07-07T17:47:19.669Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","computed":true,"selection":"version-preference"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":7.2,"impact":6,"computed":true}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"chainguard","product":"py3-vllm-cuda-12.4","name":"py3-vllm-cuda-12.4","label":"py3-vllm-cuda-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3-vllm-cuda-12.4","purlType":"apk","versions":[{"text":"< 0.11.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.10-vllm-cuda-12.4","name":"py3.10-vllm-cuda-12.4","label":"py3.10-vllm-cuda-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.10-vllm-cuda-12.4","purlType":"apk","versions":[{"text":"< 0.11.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-vllm-cuda-12.4","name":"py3.12-vllm-cuda-12.4","label":"py3.12-vllm-cuda-12.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-vllm-cuda-12.4","purlType":"apk","versions":[{"text":"< 0.11.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tritonserver-backend-vllm-cuda-12.9","name":"tritonserver-backend-vllm-cuda-12.9","label":"tritonserver-backend-vllm-cuda-12.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tritonserver-backend-vllm-cuda-12.9","purlType":"apk","versions":[{"text":"< 25.9.0_git20251016-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.9.0_git20251016-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tritonserver-backend-vllm-meta-cuda-12.9","name":"tritonserver-backend-vllm-meta-cuda-12.9","label":"tritonserver-backend-vllm-meta-cuda-12.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tritonserver-backend-vllm-meta-cuda-12.9","purlType":"apk","versions":[{"text":"< 25.9.0_git20251016-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.9.0_git20251016-r0","eol":null,"hubHref":null},{"vendor":"PyPI","product":"vllm","name":"vllm","label":"vllm","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/vllm","purlType":"pypi","versions":[{"text":"≥ 0.5.1, < 0.11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.5.1, < 0.11.0","eol":null,"hubHref":null}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-6fvq-23cw-5628","label":"github.com/vllm-project/vllm/security/advisories/GHSA-6fvq-23cw-5628","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vllm-project/vllm/pull/25794","label":"github.com/vllm-project/vllm/pull/25794","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vllm-project/vllm/commit/7977e5027c2250a4abc1f474c5619c40b4e5682f","label":"github.com/vllm-project/vllm/commit/7977e5027c2250a4abc1f474c5619c40b4e5682f","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/vllm-project/vllm","label":"github.com/vllm-project/vllm","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://pypi.org/project/vllm","label":"pypi.org/project/vllm","hostname":"pypi.org","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-6fvq-23cw-5628","label":"github.com/advisories/GHSA-6fvq-23cw-5628","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61620","label":"nvd.nist.gov/vuln/detail/CVE-2025-61620","hostname":"nvd.nist.gov","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-7MQQ-HV83-C65C","CGA-99PW-XMCJ-MWHP","CGA-WPWR-PQ9F-QX6M"]},"timeline":[{"kind":"published","date":"2026-07-07T16:03:06.869Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-07T17:47:19.669Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T01:56:57.519Z","stale":false,"partial":false}}