UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59425

API key authentication vulnerable to timing attack

Severity
High 7.5
Published
7 Oct 2025
Last changed
19 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.11.0
Also known as
GHSA-wr9h-g72x-mwhm
Sources
NVD, Project advisories (GitHub)

Description

vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when…

Affected software

SoftwareAffected versions
vLLMServers and applications · cpe:a:vllm:vllm
  • Every version before 0.11.0
  • Version 0.11.0-rc1
vLLMServers and applications · github:vllm-project/vllm
  • Every version before 0.11.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59425
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59425
  • GitHub Advisory Database https://github.com/advisories/GHSA-wr9h-g72x-mwhm
  • github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-wr9h-g72x-mwhm