CVE-2025-1953

vLLM AIBrix Prefix Caching hash.go random values

State: Published
Severity: 2.1 Low
Published: Mar 4, 2025
Updated: Mar 4, 2025
Reserved: Mar 4, 2025

Description

A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.3.0 is able to address this issue. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	2.6 Low	CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	VulDB
3.0	2.6 Low	CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	VulDB
2.0	1.4 Low	AV:A/AC:H/Au:S/C:P/I:N/A:N	VulDB

Weaknesses

CWE-330 Insufficiently Random Values
CWE-310 Cryptographic Issues

Affected Products

Product	Versions
AIBrixvLLM	0.2.0Affected

References

VDB-298543 | vLLM AIBrix Prefix Caching hash.go random valuesvdb-entry
VDB-298543 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #509958 | Vllm aibrix 0.2.0 prefix cache reusethird-party-advisory
https://github.com/vllm-project/aibrix/issues/749issue-tracking
https://github.com/vllm-project/aibrix/pull/752issue-tracking
https://github.com/vllm-project/aibrix/pull/752/commits/3d25d95aebd66f24a549200edcebc5ea423b317aissue-trackingpatch
https://github.com/vllm-project/aibrix/issues/749#event-16488517974issue-trackingpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.