Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
vLLM versions before 0.11.0 are vulnerable to a timing attack on API key validation, because the key check used a string comparison that takes longer the more leading characters match. An attacker who can send many requests to a deployment using vLLM's built-in API key authentication could use timing measurements to recover a valid key more efficiently than brute force. Upgrade to vLLM 0.11.0 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0057, the 47th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:34 UTC First seen by agentprime
- 31 Oct 2026, 14:34 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-wr9h-g72x-mwhm
- OSV: GHSA-wr9h-g72x-mwhm
- github.com/vllm-project/vllm/security/advisories/GHSA-wr9h-g72x-mwhm
- nvd.nist.gov/vuln/detail/CVE-2025-59425
- github.com/vllm-project/vllm/commit/ee10d7e6ff5875386c7f136ce8b5f525c8fcef48
- github.com/advisories/GHSA-wr9h-g72x-mwhm
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2026.yaml
- github.com/vllm-project/vllm
- github.com/vllm-project/vllm/blob/4b946d693e0af15740e9ca9c0e059d5f333b1083/vllm/entrypoints/openai/api_server.py#L1270-L1274
- github.com/vllm-project/vllm/releases/tag/v0.11.0
- pypi.org/project/vllm