VulnerabilityDeferred

CVE-2025-11915

Connection desynchronization between an HTTP proxy and the model backend.

MEDIUM 6.9EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-444
Source: f45cbf4e-4146-4068-b7e1-655ffc2c548c

References

https://cloud.google.com/vertex-ai/generative-ai/docs/security-bulletins#gcp-2025-059

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.