Deserialization of Untrusted Data

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the hfmodelweightsiterator process due to the usage of the torch.load function with the weightsonly parameter...

CVE-2025-24357

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

PYSEC-2025-58

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

CVE-2025-24357 vulnerabilities

Vulnerabilities for packages: py3.10-vllm-cuda-11.8, tritonserver-backend-vllm...

CVE-2025-24357 vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

CVE-2025-24357 vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

CVE-2025-24357

The CVE-2025-24357 issue centers on vLLM’s hf_model_weights_iterator (vllm/model_executor/weight_utils.py) which loads checkpoints via torch.load with weights_only defaulting to False. If malicious pickle data is unpickled, arbitrary code could execute on the host. This vulnerability is highlight...

PT-2025-5340 · Vllm · Vllm

Name of the Vulnerable Software and Affected Versions: vLLM versions prior to 0.7.0 Description: The issue concerns the vLLM library, specifically the vllm/model executor/weight utils.py file, which implements hf model weights iterator to load model checkpoints downloaded from Hugging Face. It...

vLLM 代码问题漏洞

vLLM is a vLLM open source high throughput and memory efficient inference and service engine for LLM. A code issue vulnerability exists in versions of vLLM prior to v0.7.0 that stems from arbitrary code execution during unpickling when torch.load loads malicious pickle data...

GHSA-WRFC-PVP9-MR9G vulnerabilities

Vulnerabilities for packages: nemo...

GHSA-QXRP-VHVM-J765 vulnerabilities

Vulnerabilities for packages: nemo...

GHSA-HXXF-235M-72V3 vulnerabilities

Vulnerabilities for packages: nemo...

CVE-2024-11394 vulnerabilities

Vulnerabilities for packages: nemo...

CVE-2024-11393 vulnerabilities

Vulnerabilities for packages: nemo...

CVE-2024-11392 vulnerabilities

Vulnerabilities for packages: nemo...

GHSA-8495-4G3G-X7PR vulnerabilities

Vulnerabilities for packages: kserve, py3-cassandra-medusa, py3.10-vllm-cuda-11.8, airflow, awx, py3.13-scanner-test-libraries-aiohttp, py3-aiohttp, request-1276, dask-gateway, checkov...

GHSA-27MF-GHQM-J3J8 vulnerabilities

Vulnerabilities for packages: py3-aiohttp, airflow, py3.10-vllm-cuda-11.8, checkov...

CVE-2024-47874 vulnerabilities

Vulnerabilities for packages: py3.10-vllm-cuda-11.8, reflex...

Denial Of Service (DoS)

vllm is vulnerable to Denial of Service DoS. The vulnerability is due to the improper handling of the bestof parameter, which fails to manage timeouts or resource exhaustion properly, allowing an attacker to overwhelm the system...

GHSA-WC36-9694-F9RF vLLM Denial of Service via the best_of parameter

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...