Vulnerability · Published Mar 4, 2025 · Assigned by VulDB

CVE-2025-1953vLLM AIBrix Prefix Caching hash.go random values

Low 2.6

In plain English

A low-severity weak randomness in AIBrix from vLLM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.3%top 81.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.3.0 is able to address this issue. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
vLLM	AIBrix	0.2.0

Weakness: CWE-330, CWE-310 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

VDB-298543 | vLLM AIBrix Prefix Caching hash.go random values vdb-entry
VDB-298543 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #509958 | Vllm aibrix 0.2.0 prefix cache reuse third-party-advisory
https://github.com/vllm-project/aibrix/issues/749 issue-tracking
https://github.com/vllm-project/aibrix/pull/752 issue-tracking
https://github.com/vllm-project/aibrix/pull/752/commits/3d25d95aebd66f24a549200edcebc5ea423b317a issue-tracking, patch
https://github.com/vllm-project/aibrix/issues/749#event-16488517974 issue-tracking, patch