{"action":"Upgrade vllm to 0.11.0 or later.","affected":[{"fixed":"0.11.0","introduced":"0"}],"component":"vllm","cve_ids":["CVE-2025-59425"],"ecosystem":"PyPI","epss":0.00566,"exploited":false,"fixed_versions":["0.11.0"],"ghsa_id":"GHSA-wr9h-g72x-mwhm","id":"tcs_01M5KGX2AE3H60C4CDT12M4VQM","modified_at":"2026-07-07T17:48:17.631626364Z","published_at":"2026-07-07T16:03:06.800906Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2026","https://github.com/vllm-project/vllm/security/advisories/GHSA-wr9h-g72x-mwhm","https://nvd.nist.gov/vuln/detail/CVE-2025-59425","https://github.com/vllm-project/vllm/commit/ee10d7e6ff5875386c7f136ce8b5f525c8fcef48","https://github.com/vllm-project/vllm","https://github.com/vllm-project/vllm/blob/4b946d693e0af15740e9ca9c0e059d5f333b1083/vllm/entrypoints/openai/api_server.py#L1270-L1274","https://github.com/vllm-project/vllm/releases/tag/v0.11.0","https://pypi.org/project/vllm","https://github.com/advisories/GHSA-wr9h-g72x-mwhm"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2026","url":"https://osv.dev/vulnerability/PYSEC-2026-2026"}],"summary":"vLLM is vulnerable to timing attack at bearer auth"}