Package: - Affected versions: >= 0.5.5 - Patched versions: 0.11.1 CVE ID: CVE-2025-62426 CVSS v3 Score: 6.5 / 10 - Attack vector: Network - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Summary: The and endpoints allow a request parameter that is used in the code before it is properly validated against the chat template. With the right parameters, it is possible to block processing of the API server for long periods of time, delaying all other requests. Fix: #27205 Credits: - russellb: Coordinator - isotropy: Remediation developer - DarkLight1337: Remediation reviewer