{"data":{"id":"f55539f4-dd2f-4b77-8829-2f1b6e08931d","title":"CVE-2025-59425: vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support…","summary":"CVE-2025-59425 affects vLLM, an inference and serving engine for large language models, before version 0.11.0rc2. Its API key validation uses a string comparison that takes longer the more characters of the key are correct. Across many attempts, an attacker could use this timing difference to recover the key character by character and bypass authentication on deployments that rely on the built-in validation.","solution":"Version 0.11.0rc2 fixes the issue.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59425","publishedAt":"2025-10-07T18:15:38.950Z","cveId":"CVE-2025-59425","cweIds":["CWE-385"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vllm@< 0.11.0 (fixed: 0.11.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM API key validation vulnerable to timing attack","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00566,"epssCheckedAt":"2026-11-04T00:12:27.710Z","kevDateAdded":null,"advisoryAliases":["GHSA-wr9h-g72x-mwhm"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:22.480Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-10-04T01:39:32.382Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:43:29.078Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.11.0","matchedVersion":"0.11.0","fixReleasedAt":"2025-10-04T01:39:32.382Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:28.928Z"}]}}