Skip to content
OpenAdvisories
Medium · 6.9 CVE-2025-11915 EUVD-2025-35358GHSA-cwmv-37m7-7829

HTTP Desynchronisation in Vertex AI for certain third-party models

Published Oct 22, 2025 · Updated Oct 23, 2025 · Assigned by GoogleCloud

Description

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

Affected products

VendorProductAffectedFixed
Google Cloud Vertex AI: Partner Models for MaaS < 2025-09-26 2025-09-26
Google Cloud Vertex AI: Open Models for MaaS < 2025-09-28 2025-09-28
Google Cloud Vertex AI: Self-Deployed Models < 2025-09-28 2025-09-28

References