CVE-2025-62426: vLLM denial of service via chat_template_kwargs in API endpoints

Executive brief

vLLM is a high-performance engine used to serve Large Language Models (LLMs). A vulnerability in its API endpoints allows an authenticated user to send specially crafted requests that freeze the server for long periods. This results in a denial of service, preventing all other users from accessing the AI model and disrupting business operations.

Technical details

A denial of service vulnerability exists in vLLM's OpenAI-compatible API server due to improper validation of the `chat_template_kwargs` parameter. In `serving_engine.py`, these arguments are unpacked and passed directly to the `apply_hf_chat_template` method in `chat_utils.py`. An attacker can provide `{"tokenize": True}` within this parameter to force a synchronous, blocking tokenization operation on the server's main event loop. By submitting a sufficiently large input, an authenticated attacker can block the event loop for extended periods, preventing the server from processing any other concurrent requests. The issue is addressed in version 0.11.1 by properly validating or restricting these keyword arguments.

Affected products

• vLLM Project vLLM >= 0.5.5, < 0.11.1

Timeline

• 2025-11-20: disclosed
• 2025-11-20: advisory
• 2025-11-20: patched

References

• https://api.github.com/users/russellb
• https://github.com/russellb
• https://api.github.com/users/russellb/gists%7B/gist_id%7D
• https://api.github.com/users/russellb/repos
• https://avatars.githubusercontent.com/u/309258?v=4
• https://api.github.com/users/russellb/events%7B/privacy%7D