CVE-2025-59425
vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in vLLM performs validation using a method that was vulnerable to a timing attack. API key validation uses a string comparison that takes longer the more characters the provided API key gets correct. Data analysis across many attempts could allow an attacker to determine when it finds the next correct character in the key sequence. Deployments relying on vLLM's built-in API key validation are vulnerable to authentication bypass using this technique. Version 0.11.0rc2 fixes the issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.57%
- CWE
- CWE-385
- Published
- 2025-10-07
- Last modified
- 2026-03-13
Affected products
- vllm-project vllm
Weakness type
Related vulnerabilities
- CVE-2026-84308 — phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
- CVE-2026-55785 — free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
- CVE-2026-6478 — PostgreSQL discloses MD5-hashed passwords via covert timing channel
- CVE-2026-5598 — Non-constant time comparisons risk private key leakage in FrodoKEM.
- CVE-2025-9231 — Timing side-channel in SM2 algorithm on 64 bit ARM
- CVE-2025-59432 — Timing Attack Vulnerability in SCRAM Authentication
- CVE-2025-49087 — In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal...
- CVE-2025-53826 — FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout