{"action":"Upgrade vllm to 0.11.0 or later.","affected":[{"fixed":"0.11.0","introduced":"0"}],"component":"vllm","cve_ids":["CVE-2025-59425"],"ecosystem":"PyPI","epss":0.00566,"exploited":false,"fixed_versions":["0.11.0"],"ghsa_id":"GHSA-wr9h-g72x-mwhm","id":"tcs_01M5KG2TKZQX0HWQJQR2VDREHX","modified_at":"2026-09-10T03:50:30.288567114Z","published_at":"2025-10-07T17:24:47Z","references":["https://osv.dev/vulnerability/GHSA-wr9h-g72x-mwhm","https://github.com/vllm-project/vllm/security/advisories/GHSA-wr9h-g72x-mwhm","https://nvd.nist.gov/vuln/detail/CVE-2025-59425","https://github.com/vllm-project/vllm/commit/ee10d7e6ff5875386c7f136ce8b5f525c8fcef48","https://github.com/advisories/GHSA-wr9h-g72x-mwhm","https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2026.yaml","https://github.com/vllm-project/vllm","https://github.com/vllm-project/vllm/blob/4b946d693e0af15740e9ca9c0e059d5f333b1083/vllm/entrypoints/openai/api_server.py#L1270-L1274","https://github.com/vllm-project/vllm/releases/tag/v0.11.0","https://pypi.org/project/vllm"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-wr9h-g72x-mwhm","url":"https://osv.dev/vulnerability/GHSA-wr9h-g72x-mwhm"}],"summary":"vLLM is vulnerable to timing attack at bearer auth"}