6 matches found
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recvobject deserializes received object bytes using pickle.loads without sanitization, leading to a remote code execution vulnerability. Maintainer...
CVE-2024-9052
A flaw was found in the vLLM distributed training API. This vulnerability allows remote code execution via unsafe deserialization, which uses pickle.loads without sanitization...
CVE-2024-9052
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-9052
Summary: CVE-2024-9052 relates to a deserialization flaw in the vLLM project’s distributed training API. The issue enables remote code execution via unsafe deserialization of object bytes using pickle.loads() without sanitization, specifically within the vllm.distributed.GroupCoordinator.recv_obj...
