Google Vertex AI CVE-2025-11915

Exploitation requires sending crafted HTTP requests to Google Cloud Vertex AI generative-AI endpoints whose front-end proxy sits in front of an impacted model backend, triggering connection desynchronization (HTTP request smuggling) between proxy and backend; no authentication or user interaction is needed per the PR:N/UI:N vector. The decisive limiting factor is that this is a flaw in Google's managed proxy infrastructure, not customer-deployed software: it is only exploitable against the vulnerable Google-hosted proxy tier, and that tier was fully patched across all affected models by 2025-09-28, after which the condition is no longer reachable and customers need take no action.

Signals are consistent and point to a low-to-moderate, now-remediated risk. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but impact is capped at VC:L/VI:N/VA:L with subsequent-system impact SC:L/SA:L - i.e. limited confidentiality/availability effects from cross-connection desync rather than code execution or full data compromise, yielding a Medium 6.9. EPSS is low (0.32%, 24th percentile), there is no CISA KEV listing and no public exploit identified, so there is no indication of active or imminent widespread exploitation. Most importantly, the Google Cloud bulletin states the fix was fully rolled out server-side across all proxies in front of impacted models by 2025-09-28 and that users need take no action - so for a managed-service consumer the present actionable risk is effectively nil. This is a genuine request-smuggling/information-disclosure class issue (CWE-444) but not a customer-actionable priority; it is a 'moderate-severity, already-fixed infrastructure bug' rather than a high-urgency threat. Note: only a CVSS 4.0 vector is provided (no 3.1), and the specific list of 'impacted models' is not enumerated in the supplied data.

A remote, unauthenticated attacker sends crafted HTTP requests to a Vertex AI generative-AI endpoint, exploiting connection desynchronization between the front-end HTTP proxy and the model backend to misalign request/response boundaries. As a result, the attacker's connection could be served another user's model response (or vice versa), leaking limited data across sessions. No public exploit has been identified, and the condition was remediated in Google's infrastructure as of 2025-09-28.