747 matches found
CVE-2024-9053 Remote Code Execution in vllm-project/vllm
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality runserverloop calls the function makehandlercoro, which directly uses cloudpickle.loads on received messages without any sanitization. This can result in remote code...
CVE-2024-9052
Summary: CVE-2024-9052 relates to a deserialization flaw in the vLLM project’s distributed training API. The issue enables remote code execution via unsafe deserialization of object bytes using pickle.loads() without sanitization, specifically within the vllm.distributed.GroupCoordinator.recv_obj...
编号撤回
vLLM is vLLM open source a high throughput and memory efficient inference and service engine for LLM. This CVE number has been withdrawn...
PT-2025-12262 · Vllm · Vllm
Name of the Vulnerable Software and Affected Versions: vllm-project vllm version 0.6.0 Description: The issue concerns a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality run server loop calls the function make handler coro, which directly uses...
vLLM 代码问题漏洞
vLLM is a vLLM open source high throughput and memory efficient reasoning and serving engine for LLM. A code issue vulnerability exists in vLLM version v0.6.2, which stems from a remote code execution vulnerability in the MessageQueue.dequeue API function...
编号撤回
vLLM is vLLM open source a high throughput and memory efficient inference and service engine for LLM. This CVE number has been withdrawn...
vLLM 操作系统命令注入漏洞
vLLM is a vLLM open source high throughput and memory efficient inference and service engine for LLM. An operating system command injection vulnerability exists in vLLM version 0.6.0, which stems from a failure to clean up deserialized data in the AsyncEngineRPCServer function, which could lead t...
CVE-2025-29770
A flaw was found in vLLM. This vulnerability can allow Denial of Service via filesystem exhaustion. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicabilit...
PYSEC-2025-63
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...
CVE-2025-29783
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...
PYSEC-2025-223
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support structured output a.k.a. guided decoding. Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has...
CVE-2025-29770
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support structured output a.k.a. guided decoding. Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has...
GHSA-X3M8-F7G5-QHM7 vLLM Allows Remote Code Execution via Mooncake Integration
Summary When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts. Details 1. Pickle deserialization vulnerabilities are well documented. 2. The mooncake pipe is exposed over the network by design...
vLLM Allows Remote Code Execution via Mooncake Integration
Summary When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts. Details 1. Pickle deserialization vulnerabilities are well documented. 2. The mooncake pipe is exposed over the network by design...
Deserialization of Untrusted Data
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the MooncakePipe class, which relies on pickle for serialization and deserialization in recvtensor. An attacker...
Allocation of Resources Without Limits or Throttling
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in outlineslogitsprocessors.py module, which uses a local cache with unbounded size by default...
vLLM denial of service via outlines unbounded cache on disk
Impact The outlines library is one of the backends used by vLLM to support structured output a.k.a. guided decoding. Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has been on by default in vLLM. Outlines is also available by default through the...
GHSA-MGRM-FGJV-MHV8 vLLM denial of service via outlines unbounded cache on disk
Impact The outlines library is one of the backends used by vLLM to support structured output a.k.a. guided decoding. Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has been on by default in vLLM. Outlines is also available by default through the...