Low severity · published Mar 4, 2025
CVE-2025-1953
vLLM AIBrix Prefix Caching hash.go random values
2.6
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.3.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AIBrix · vLLM
0.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1953
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1953
github.com
https://github.com/vllm-project/aibrix/issues/749
github.com
https://github.com/vllm-project/aibrix/issues/749#event-16488517974
github.com
https://github.com/vllm-project/aibrix/pull/752
github.com
https://github.com/vllm-project/aibrix/pull/752/commits/3d25d95aebd66f24a549200edcebc5ea423b317a
vuldb.com
https://vuldb.com/?ctiid.298543
vuldb.com
https://vuldb.com/?id.298543
