CVE-2025-46570 vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel
Attackers can exploit timing differences in prefix caching to infer sensitive information about processed prompts in vLLM.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-46570?
CVE-2025-46570 is a low-severity vulnerability in Vllm Vllm, published on 29 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). These timing differences caused by matching chunks are significant enough to be recognized and exploited. This issue has been patched in version 0.9.0.
Which versions are affected by CVE-2025-46570?
3 open source packages ship an affected version, including vllm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vllm PyPI | All versions | 0.9.0 |
vllm PyPI | All versions | 0.9.0 |
vllm PyPI | All versions | 0.9.0 |
Products include Vllm Vllm.
How do I fix CVE-2025-46570?
Upgrade vllm to 0.9.0 or later.
Is CVE-2025-46570 being exploited?
There is no known exploitation of CVE-2025-46570 in the wild and no public exploit code.
Other vulnerabilities in Vllm Vllm
- CVE-2025-32444 vLLM Vulnerable to Remote Code Execution via Mooncake Integration
- CVE-2026-22778 vLLM leaks a heap address when PIL throws an error
- CVE-2025-47277 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
- CVE-2024-11041 Remote Code Execution in vllm-project/vllm
- CVE-2026-48746 vLLM: OpenAI auth bypass
Sources
Also known as GHSA-4qjh-9fv9-r85r, PYSEC-2025-53.