CVE-2025-46570

Katalog CVE

CVSS 2.6 · Low EPSS 0,34%

Kerentanan Observable Timing Discrepancy pada vllm. Skor CVSS 3.1 2.6 (Low) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). These timing differences caused by matching chunks are significant enough to be recognized and exploited. This issue has been patched in version 0.9.0.

Rincian

Terbit di NVD

29 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.6 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/pull/17045 issue tracking · advisory vendor
• https://github.com/vllm-project/vllm/security/advisories/GHSA-4qjh-9fv9-r85r advisory vendor
• https://github.com/vllm-project/vllm/commit/77073c77bc2006eb80ea6d5128f076f5e6c6f54f patch