CVE-2025-11915CWE-444

CVE-2025-11915

published October 22, 2025

CVSS
6.9
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00322 · 24.0th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2025-10-22T14:15Z
References (1)
https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2025-059 · f45cbf4e-4146-4068-b7e1-655ffc2c548c
EPSS history
Timeline
  • 22 OCT 09:13Z
    HTTP Desynchronisation in Vertex AI for certain third-party models
    cvelistv5