CVE-2025-62426: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

Summary The /v1/chat/completions and /tokenize endpoints allow a chattemplatekwargs request parameter that is used in the code before it is properly validated against the chat template. With the right chattemplatekwargs parameters, it is possible to block processing of the API server for long periods of time, delaying all other requests

Details In servingengine.py, the chattemplatekwargs are unpacked into kwargs passed to chatutils.py applyhfchattemplate with no validation on the keys or values in that chattemplatekwargs dict. This means they can be used to override optional parameters in the applyhfchattemplate method, such as tokenize, changing its default from False to True.

https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/openai/servingengine.py#L809-L814

https://github.com/vllm-project/vllm/blob/2a6dc67eb520ddb9c4138d8b35ed6fe6226997fb/vllm/entrypoints/chatutils.py#L1602-L1610

Both servingchat.py and servingtokenization.py call into this preprocesschat method of servingengine.py and they both pass in chattemplatekwargs.

So, a chattemplatekwargs like {"tokenize": True} makes tokenization happen as part of applying the chat template, even though that is not expected. Tokenization is a blocking operation, and with sufficiently large input can block the API server's event loop, which blocks handling of all other requests until this tokenization is complete.

This optional tokenize parameter to applyhfchattemplate does not appear to be used, so one option would be to just hard-code that to always be False instead of allowing it to be optionally overridden by callers. A better option may be to not pass chattemplatekwargs as unpacked kwargs but instead as a dict, and only unpack them after the logic in applyhfchattemplate that resolves the kwargs against the chat template.

Impact

Any authenticated user can cause a denial of service to a vLLM server with Chat Completion or Tokenize requests.

Fix

https://github.com/vllm-project/vllm/pull/27205