CVE-2025-62426 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints…
Medium CVSS: 6.5

CVE-2025-62426

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/chat/completions and /tokenize endpoints allow a chat_template_kwargs request parameter that is used in the code before it is properly validated against the chat template. With the right chat_template_kwargs parameters, it is possible to block processing of the API server for long periods of time, delaying all other requests. This issue has been patched in version 0.11.1.
Vendor
Vllm
Product
Vllm
CWE
CWE-770
Yayın Tarihi
2025-11-21 02:15:43
Güncelleme
2025-12-04 17:42:10
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-770 Vllm MEDIUM Vllm 2025

Referanslar

https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/chat_utils.py#L1602-L1610 https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/openai/serving_engine.py#L809-L814 https://github.com/vllm-project/vllm/commit/3ada34f9cb4d1af763fdfa3b481862a93eb6bd2b https://github.com/vllm-project/vllm/pull/27205 https://github.com/vllm-project/vllm/security/advisories/GHSA-69j4-grxj-j64p