CVE-2025-11915
Medium
Description
Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.
SeverityMedium
CVSS6.9
Exploit probability—
Product
Vertex AI: Partner Models for MaaS
PublishedOct 22, 2025
First seenOct 22, 2025
Weakness typeCWE-444CWE-444
How to fix
Update
- Google Cloud Vertex AI: Partner Models for MaaS2025-09-26 or later
- Google Cloud Vertex AI: Open Models for MaaS2025-09-28 or later
- Google Cloud Vertex AI: Self-Deployed Models2025-09-28 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Cloud Vertex AI: Partner Models for MaaS | v < 2025-09-26 | 2025-09-26 |
| Google Cloud Vertex AI: Open Models for MaaS | v < 2025-09-28 | 2025-09-28 |
| Google Cloud Vertex AI: Self-Deployed Models | v < 2025-09-28 | 2025-09-28 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.