CVE-2025-62426Medium· 6.5▾ SunlitA vulnerability in vLLM allows an authenticated user to trigger unintended tokenization during chat template processing by supplying crafted chat_template_kwargs to the /v1/chat/completions or /tokenize endpoints. By forcing the server to …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.4%
Last analysed / modified upstream
A vulnerability in vLLM allows an authenticated user to trigger unintended tokenization during chat template processing by supplying crafted chat_template_kwargs to the /v1/chat/completions or /tokenize endpoints. By forcing the server to tokenize very large inputs, an attacker can block the API server’s event loop for extended periods, causing a denial of service and delaying all other requests.
vllm: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted chat_template_kwargs — rated Moderate by Red Hat. Released 2025-11-21, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461 https://access.redhat.com/errata/RHSA-2026:3461 For more information visit https://access.redhat.com/errata/RHSA-2026:3462 https://access.redhat.com/errata/RHSA-2026:3462
Workarounds / mitigations:
Affected packages:
vllm >= 0.5.5, < 0.11.1Patched in:
vllm 0.11.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-48956High· 7.5vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests (CVE-2025-48956)
CVE-2025-69228Medium· 6.8aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request (CVE-2025-69228)
CVE-2025-11374Medium· 6.5github.com/hashicorp/consul: Consul's KV endpoint is vulnerable to denial of service (CVE-2025-11374)
CVE-2026-18618High· 7.5A flaw was found in ml-metadata
CVE-2025-2559Medium· 4.9A flaw was found in Keycloak
CVE-2026-10832Medium· 5.9A flaw was found in the DERDecoder class within wildfly-elytron-asn1