Timing Attack Vulnerability in vLLM API Key Validation

CVE-2025-59425

What is CVE-2025-59425?

vLLM, an inference and serving engine for large language models, contains a vulnerability related to its API key validation mechanism. Prior to version 0.11.0rc2, the validation process employed a string comparison method susceptible to timing attacks, which allowed attackers to exploit the increased response time for correct character sequences. This exploitation could lead to an authentication bypass, as the attacker could deduce the next correct character in the key. Users should upgrade to version 0.11.0rc2 or later to mitigate this issue.

References