id: PYSEC-2025-53
modified: 2025-06-26T21:23:06.231251Z
published: 2025-05-29T17:15:21Z
aliases:
- CVE-2025-46570
- GHSA-4qjh-9fv9-r85r
details: vLLM is an inference and serving engine for large language models (LLMs).
  Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism
  finds a matching prefix chunk, the prefill process speeds up, which is reflected
  in the TTFT (Time to First Token). These timing differences caused by matching chunks
  are significant enough to be recognized and exploited. This issue has been patched
  in version 0.9.0.
affected:
- package:
    ecosystem: PyPI
    name: vllm
    purl: pkg:pypi/vllm
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 77073c77bc2006eb80ea6d5128f076f5e6c6f54f
    repo: https://github.com/vllm-project/vllm
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.9.0
  versions:
  - 0.0.1
  - 0.1.0
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.1.4
  - 0.1.5
  - 0.1.6
  - 0.1.7
  - 0.2.0
  - 0.2.1
  - 0.2.1.post1
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - 0.2.6
  - 0.2.7
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.4.0
  - 0.4.0.post1
  - 0.4.1
  - 0.4.2
  - 0.4.3
  - 0.5.0
  - 0.5.0.post1
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.5.3.post1
  - 0.5.4
  - 0.5.5
  - 0.6.0
  - 0.6.1
  - 0.6.1.post1
  - 0.6.1.post2
  - 0.6.2
  - 0.6.3
  - 0.6.3.post1
  - 0.6.4
  - 0.6.4.post1
  - 0.6.5
  - 0.6.6
  - 0.6.6.post1
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.5.post1
references:
- type: ADVISORY
  url: https://github.com/vllm-project/vllm/pull/17045
- type: ADVISORY
  url: https://github.com/vllm-project/vllm/security/advisories/GHSA-4qjh-9fv9-r85r
- type: FIX
  url: https://github.com/vllm-project/vllm/commit/77073c77bc2006eb80ea6d5128f076f5e6c6f54f
- type: REPORT
  url: https://github.com/vllm-project/vllm/pull/17045