CVE-2025-11915: Google Cloud Vertex Ai: Open Models For Maas

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

Affected products

• Google Cloud Vertex Ai: Open Models For Maas: before 2025-09-28 (fixed in 2025-09-28)
• Google Cloud Vertex Ai: Partner Models For Maas: before 2025-09-26 (fixed in 2025-09-26)
• Google Cloud Vertex Ai: Self-Deployed Models: before 2025-09-28 (fixed in 2025-09-28)

Published 2025-10-22. Last modified 2026-06-17.