CVE-2025-11915 Overview
CVE-2025-11915 is an HTTP request smuggling vulnerability caused by connection desynchronization between an HTTP proxy and a model backend in Google Cloud Vertex AI generative AI infrastructure. The flaw allows requests to be interpreted differently by the front-end proxy and the back-end model server. Google rolled out fixes for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action. The vulnerability is tracked under CWE-444: Inconsistent Interpretation of HTTP Requests, commonly referred to as HTTP request smuggling.
Critical Impact
Connection desynchronization between an HTTP proxy and a model backend could allow an attacker to smuggle requests, potentially affecting request confidentiality, availability, and downstream system integrity.
Affected Products
- Google Cloud Vertex AI generative AI models fronted by the affected HTTP proxies
- Proxies serving Vertex AI model endpoints prior to the 2025-09-28 rollout
- Downstream applications relying on Vertex AI model responses during the exposure window
Discovery Timeline
- 2025-09-28 - Fixes rolled out for all proxies in front of impacted Vertex AI models
- 2025-10-22 - CVE-2025-11915 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11915
Vulnerability Analysis
CVE-2025-11915 is a request smuggling condition [CWE-444] arising when an HTTP proxy and the Vertex AI model backend interpret the boundaries of HTTP requests differently. When these two components disagree on where one request ends and the next begins, an attacker can craft ambiguous request frames that desynchronize the shared connection. The proxy forwards what it considers a single request, while the backend parses a second smuggled request appended to it.
This class of flaw enables cache poisoning, response queue poisoning, request routing bypass, and leakage of adjacent requests on pooled backend connections. In the context of a generative AI service, smuggled requests could reach model endpoints under attacker-controlled framing, potentially influencing prompts, responses, or authorization decisions handled at the proxy layer. Google resolved the desynchronization at the proxy tier without requiring customer action.
Root Cause
The root cause is inconsistent HTTP message parsing between the fronting proxy and the model backend. Discrepancies in handling of Content-Length, Transfer-Encoding: chunked, or malformed framing headers permit one component to treat trailing bytes as body content while the other treats them as a new request. This desynchronization violates the RFC 9112 requirement that intermediaries and origins share a consistent view of message boundaries.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request with ambiguous framing to a public Vertex AI model endpoint. The proxy accepts the request and forwards it over a pooled connection to the backend, which interprets an additional smuggled request. Because reference implementations and technical details are not published, the specific header manipulation vector is not disclosed. Refer to the Google Cloud Security Bulletin GCP-2025-059 for the vendor-provided description.
Detection Methods for CVE-2025-11915
Indicators of Compromise
- Anomalous HTTP requests to Vertex AI endpoints containing both Content-Length and Transfer-Encoding headers
- Unexpected response mismatches where clients receive responses intended for different requests
- Elevated 400-class errors from Vertex AI proxies during the pre-patch window prior to 2025-09-28
Detection Strategies
- Inspect egress traffic to *.googleapis.com Vertex AI endpoints for HTTP smuggling payload patterns, including conflicting framing headers
- Correlate application logs with cloud audit logs to identify request-response pairing anomalies during the exposure window
- Review web application firewall telemetry for requests containing chunked encoding anomalies or oversized header sets targeting model endpoints
Monitoring Recommendations
- Enable Google Cloud Audit Logs for Vertex AI API calls and forward them to a central analytics platform
- Monitor for unauthorized model invocations or prompts that do not match legitimate application workflows
- Establish baselines for request volume, latency, and error rates against Vertex AI endpoints to identify deviations
How to Mitigate CVE-2025-11915
Immediate Actions Required
- No customer action is required. Google completed proxy-side fixes across all impacted Vertex AI models by 2025-09-28
- Verify that applications interacting with Vertex AI use current Google Cloud client libraries and TLS-enforced endpoints
- Review audit logs covering the period before 2025-09-28 for unexpected model invocations or response anomalies
Patch Information
Google applied the fix at the proxy tier fronting Vertex AI generative AI models. The rollout completed on 2025-09-28 and requires no customer intervention. Full details are available in the Google Cloud Security Bulletin GCP-2025-059.
Workarounds
- No workarounds are required because the vulnerability was remediated at the Google-managed proxy tier
- Enforce strict HTTP client behavior in downstream applications by using well-maintained HTTP libraries that reject ambiguous framing
- Restrict outbound access to Vertex AI endpoints via VPC Service Controls to limit exposure of model traffic to trusted networks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
