PT-2025-9703 · Unknown · Vllm Aibrix

Kexinoh · Published 2025-03-04 · Updated 2025-03-05 · CVE-2025-1953

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions vLLM AIBrix version 0.2.0

Description A vulnerability has been found in the Prefix Caching component, specifically in the file pkg/plugins/gateway/prefixcacheindexer/hash.go. This issue leads to insufficiently random values. The complexity of an attack is rather high, and the exploitation appears to be difficult.

Recommendations For vLLM AIBrix version 0.2.0, upgrade to version 0.3.0 to address this issue. It is recommended to upgrade the affected Prefix Caching component.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

CWE-310

Related Identifiers

CVE-2025-1953

Affected Products

Vllm Aibrix

References · 12

• https://github.com/vllm-project/aibrix/issues/749#event-16488517974 · Patch
• https://github.com/vllm-project/aibrix/pull/752/commits/3d25d95aebd66f24a549200edcebc5ea423b317a · Patch
• https://osv.dev/vulnerability/CVE-2025-1953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1953 · Security Note
• https://github.com/vllm-project/aibrix/issues/749 · Note
• https://github.com/vllm-project/aibrix/pull/752 · Note
• https://t.me/cvedetector/19537 · Telegram Post
• https://vuldb.com/?id.298543 · Note
• https://vuldb.com/?ctiid.298543 · Note
• https://twitter.com/VulmonFeeds/status/1897124131054764137 · Twitter Post
• https://vuldb.com/?submit.509958 · Note
• https://twitter.com/CVEnew/status/1897133263568748677 · Twitter Post