Database/AI/ML frameworks & serving
vLLM (API key comparison): Timing attack recovers the API key
CVE-2025-59425AI/ML frameworks & servingcurated
Impact
Timing attack recovers the API key
Who can reach it
Unauthenticated network to the serving port
What to do
Upgrade to 0.11.0+; do not rely on vLLM's own API key as the tenant auth boundary — front it with a gateway
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.