994 matches found
CVE-2024-11041 Remote Code Execution in vllm-project/vllm
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue,...
CVE-2024-11041 Remote Code Execution in vllm-project/vllm
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue,...
CVE-2024-11041 Remote Code Execution in vllm-project/vllm
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue,...
CVE-2024-11041
vllm-project vLLM version 0.6.2 contains a vulnerability in MessageQueue.dequeue() where pickle.loads is used to parse received sockets, enabling remote code execution if a malicious payload is sent to the MessageQueue. Multiple sources (CVE-2024-11041 entries across OSV, RH Red Hat, GHSA, CHAING...
CVE-2024-9053
CVE-2024-9053 affects vllm-project/vllm 0.6.0, specifically the AsyncEngineRPCServer entrypoints. The run_server_loop() path calls _make_handler_coro() which uses cloudpickle.loads() on received messages without sanitization, enabling remote code execution via deserialization of untrusted data (n...
CVE-2024-9053 Remote Code Execution in vllm-project/vllm
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality runserverloop calls the function makehandlercoro, which directly uses cloudpickle.loads on received messages without any sanitization. This can result in remote code...
CVE-2024-9053 Remote Code Execution in vllm-project/vllm
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality runserverloop calls the function makehandlercoro, which directly uses cloudpickle.loads on received messages without any sanitization. This can result in remote code...
CVE-2024-9052
Summary: CVE-2024-9052 relates to a deserialization flaw in the vLLM project’s distributed training API. The issue enables remote code execution via unsafe deserialization of object bytes using pickle.loads() without sanitization, specifically within the vllm.distributed.GroupCoordinator.recv_obj...
编号撤回
vLLM is vLLM open source a high throughput and memory efficient inference and service engine for LLM. This CVE number has been withdrawn...
vLLM 代码问题漏洞
vLLM is a vLLM open source high throughput and memory efficient reasoning and serving engine for LLM. A code issue vulnerability exists in vLLM version v0.6.2, which stems from a remote code execution vulnerability in the MessageQueue.dequeue API function...
vLLM 操作系统命令注入漏洞
vLLM is a vLLM open source high throughput and memory efficient inference and service engine for LLM. An operating system command injection vulnerability exists in vLLM version 0.6.0, which stems from a failure to clean up deserialized data in the AsyncEngineRPCServer function, which could lead t...
PT-2025-12262 · Vllm · Vllm
Name of the Vulnerable Software and Affected Versions: vllm-project vllm version 0.6.0 Description: The issue concerns a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality run server loop calls the function make handler coro, which directly uses...
编号撤回
vLLM is vLLM open source a high throughput and memory efficient inference and service engine for LLM. This CVE number has been withdrawn...
CVE-2025-29770
A flaw was found in vLLM. This vulnerability can allow Denial of Service via filesystem exhaustion. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicabilit...
CVE-2025-29783
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...
PYSEC-2025-63
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code...
CVE-2025-29770
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. The outlines library is one of the backends used by vLLM to support structured output a.k.a. guided decoding. Outlines provides an optional cache for its compiled grammars on the local filesystem. This cache has...