CVE-2025-46570 — vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

Affected: vllm-project vllm

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). These timing differences caused by matching chunks are significant enough to be recognized and exploited. This issue has been patched in version 0.9.0.

GHSA-4qjh-9fv9-r85r — Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching

Affected: PyPI: vllm

This issue arises from the prefix caching mechanism, which may expose the system to a timing side-channel attack.

## Description When a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). Our tests revealed that the timing differences caused by matching chunks are significant enough to be recognized and exploited.

For instance, if the victim has submitted a sensitive prompt or if a valuable system prompt has been cached, an attacker sharing the same backend could attempt to guess the victim's input. By measuring the TTFT based on prefix matches, the attacker could verify if their guess is correct, leading to potential leakage of private information.

Unlike token-by-token sharing mechanisms, vLLM’s chunk-based approach (PageAttention) processes tokens in larger units (chunks). In our tests, with chunk_size=2, the timing differences became noticeable enough to allow attackers to infer whether portions of their input match the victim's prompt at the chunk level.

## Environment

- GPU: NVIDIA A100 (40G) - CUDA: 11.8 - PyTorch: 2.3.1 - OS: Ubuntu 18.04 - vLLM: v0.5.1 Configuration: We launched vLLM using the default settings and adjusted chunk_size=2 to evaluate the TTFT.

## Leakage We conducted our tests using LLaMA2-70B-GPTQ on a single device. We analyzed the timing differences when prompts shared prefixes of 2 chunks, and plotted the corresponding ROC c…

Most recent entries from all

CVE-2025-46570 — vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

GHSA-4qjh-9fv9-r85r — Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching