Medium severity · published Oct 22, 2025
CVE-2025-11915
HTTP Desynchronisation in Vertex AI for certain third-party models
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Vertex AI: Open Models for MaaS · Google Cloud
before 2025-09-28 · source: vendor
VA
Vertex AI: Partner Models for MaaS · Google Cloud
before 2025-09-26 · source: vendor
VA
Vertex AI: Self-Deployed Models · Google Cloud
before 2025-09-28 · source: vendor
Affected product
VA
Vertex AI: Open Models for MaaS
Google Cloud