Executive brief
vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server
Affected products
- PyPI vllm
Junglewise Threat Intelligence
CVE-2025-61620: PYSEC-2026-2013 - vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server
CVE-2025-61620 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: vllm (PyPI). Vendors: PyPI.
Related threats
- vLLM LlavaOnevision2 processor remote code execution via trust_remote_code bypass
- vLLM SSRF and arbitrary file read in MiMoV2OmniMultiModalProcessor
- vLLM integer overflow in kernel causing cross-user data leak
- vLLM concurrent prompt-embedding guard bypass
- vLLM ReDoS in lm-format-enforcer backend regex parsing