PT-2025-9703

CVE-2025-1953

Published

2025-03-04

Updated

2025-03-05

Description by

CVSS 4.0

2.1

Low

MetricsAV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions vLLM AIBrix version 0.2.0

Description A vulnerability has been found in the Prefix Caching component, specifically in the file pkg/plugins/gateway/prefixcacheindexer/hash.go. This issue leads to insufficiently random values. The complexity of an attack is rather high, and the exploitation appears to be difficult.

Recommendations For vLLM AIBrix version 0.2.0, upgrade to version 0.3.0 to address this issue. It is recommended to upgrade the affected Prefix Caching component.

Exploitability

Exploit

Fix

Impacts

Researchers

Kexinoh

Vendors

Affected products

Weakness enumeration

CWE-310

CWE-330: Use of Insufficiently Random Values

Related identifiers