CVE-2024-11041

A flaw was found in the vLLM MessageQueue. This vulnerability allows remote code execution via the MessageQueue.dequeue function, which improperly uses pickle.loads to parse received sockets, enabling an attacker to execute arbitrary code by sending a malicious payload. Mitigation Mitigation for...

CVE-2024-11041

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue,...

CVE-2024-11041

vllm-project vLLM version 0.6.2 contains a vulnerability in MessageQueue.dequeue() where pickle.loads is used to parse received sockets, enabling remote code execution if a malicious payload is sent to the MessageQueue. Multiple sources (CVE-2024-11041 entries across OSV, RH Red Hat, GHSA, CHAING...