Google Vertex AI API Vulnerabilities: GCP-2025-059 Streaming Response Routing Error and CVE-2024-12226 VPC Service Controls Bypass

Critical Vulnerability Information GCP-2025-059 Release Date: 2025-10-21 Severity: Medium Description: - On September 23, 2025, a technical issue in the Vertex AI API was discovered, causing responses from certain third-party models to be incorrectly routed to a limited number of recipients when using streaming requests. - The issue has been resolved. Google models (such as Gemini) were not affected. - Internal platforms and client libraries correctly handle requests with the "Expect: 100-continue" header, but there was a serialization issue in streaming response connections, causing a response from one request to be mistakenly delivered as the response for a subsequent request. Impact Scope: - Different models were fixed at different times: - Anthropic Partner Model-as-a-Service models (Claude): 12:45 AM PDT on September 26, 2025 - All Open Models as a Service models: 7:43 AM PDT on September 28, 2025 - Mistral and A21 Partner Model-as-a-Service models: 11:00 AM PDT on September 28, 2025 - Self-deployed models: 7:10 PM PDT on September 28, 2025 Mitigation: - A fix was implemented to properly handle the "Expect: 100-continue" header and prevent recurrence of the issue. - Additional testing, monitoring, and alerting have been added to enable rapid detection of similar problems. GCP-2024-063 Release Date: 2024-12-06 Severity: Medium CVE ID: CVE-2024-12226 Description: - A vulnerability was identified in the Vertex AI API service for Gemini multimedia requests, allowing bypass of VPC Service Controls. Attackers could potentially exploit the fileURI parameter to exfiltrate data from the API. Impact Scope: - The vulnerability can be exploited when the fileURI parameter is used to specify a media file URL and VPC Service Controls are enabled. Mitigation: - A fix was implemented to return an error message when a media file URL is specified via the fileURI parameter. - Other use cases are unaffected.

Goal Reached Thanks to every supporter — we hit 100%!

Google Vertex AI API Vulnerabilities: GCP-2025-059 Streaming Response Routing Error and CVE-2024-12226 VPC Service Controls Bypass