Cached prompt disclosure via prefix-match timing oracle

Observable timing discrepancy in vLLM before 0.9.0 allows remote authenticated users to infer cached prompt content via prompt timing. Prefix caching shortens time to first token when an attacker-controlled prompt matches cached chunks, turning cache hits into an oracle for guessed text. Exploitation requires a shared backend, victim-cached content, and repeated timing measurements; disclosed tests inferred chunk-level matches only.