Vulnerability · Published Oct 22, 2025 · Assigned by GoogleCloud
CVE-2025-11915HTTP Desynchronisation in Vertex AI for certain third-party models
Medium 6.9
In plain English
A medium-severity security flaw in Vertex AI: Open Models for MaaS from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Vertex AI: Partner Models for MaaS | 0 – before 2025-09-26 |
| Google Cloud | Vertex AI: Open Models for MaaS | 0 – before 2025-09-28 |
| Google Cloud | Vertex AI: Self-Deployed Models | 0 – before 2025-09-28 |
Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/U:Clear