CVE-2025-62426: vllm-project vllm
Vulnerability summary
CVE-2025-62426 is a medium (CVSS 6.5) vulnerability in vllm-project vllm. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 21-11-2025PublishedVulnerability first disclosed.
- 24-11-2025Last modifiedVulnerability information updated.
Description
vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_template_kwargs request parameter that is used in the code before it is properly validated against the chat template. With the right chat_template_kwargs parameters, it is possible to block processing of the API server for long periods of time, delaying all other requests. This issue has been patched in version 0.11.1.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.13 pp
From 0.37% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- tritonserver-backend-vllm-meta-cuda-12.9< 25.9.0_git20251112-r1
PyPI1 product
- vllm≥ 0.5.5, < 0.11.1
Vllm1 product
- vllm≥ 0.5.5, < 0.11.1 | 0.11.1:rc0 | 0.11.1:rc1
Vllm-project1 product
- vllm≥ 0.5.5, < 0.11.1
4 vendors · 4 products
References
11 links- github.com/vllm-project/vllm/security/advisories/GHSA-69j4-grxj-j64pX Refsource CONFIRMWEBAdvisoryVendor Advisory
- github.com/vllm-project/vllm/commit/3ada34f9cb4d1af763fdfa3b481862a93eb6bd2bX Refsource MISCWEBFIXPatch
- github.com/vllm-project/vllmPACKAGE