vllm-project / vllm-project/aibrix
release-0.2 still uses unseeded xxhash in PrefixHashTable (CVE-2025-1953)
- Dominant language
- Go
- Stars
- 5.1k
- Forks
- 694
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 98
Description
`pkg/plugins/gateway/prefixcacheindexer/hash.go` on `release-0.2` still calls `xxhash.Sum64(IntArrayToByteArray(chunk))` directly inside `MatchPrefix` and `AddPrefix` -- there's no `xxhash.NewWithSeed`, no random `seed` field on `PrefixHashTable`, and no `math/rand` import.
Upstream commit [`3d25d95a`](https://github.com/vllm-project/aibrix/commit/3d25d95aebd66f24a549200edcebc5ea423b317a) (*Use random seed for xxhash*) is the fix advertised for **CVE-2025-1953**. It introduces a per-instance random seed (`r := rand.New(rand.NewSource(time.Now().Unix())); seed := r.Uint64()`) wired through `xxhash.NewWithSeed(seed)` so the prefix-cache hash table is no longer keyed by an attacker-predictable hash.
Without that, a request issuer that can guess the hash function can craft inputs that collide on the cache key, which is the scenario the CVE describes. This branch may want a backport, even if the import path also needs the `aibrix/aibrix -> vllm-project/aibrix` migration touched up. -- `vulgraph`
Contributor guide
Assessment
This issue has not been assessed yet.