CVE-2024-9053

CVE-2024-9053 affects vllm-project/vllm 0.6.0, specifically the AsyncEngineRPCServer entrypoints. The run_server_loop() path calls _make_handler_coro() which uses cloudpickle.loads() on received messages without sanitization, enabling remote code execution via deserialization of untrusted data (n...