Remote Code Execution (RCE)

🗓️ 25 Mar 2025 04:46:20Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 5 Views

vllm is vulnerable to Remote Code Execution due to unsafe deserialization with pickle.loads().

Reporter	Title	Published	Views	Family All 13
Chainguard	CVE-2024-9052 vulnerabilities	25 Mar 202504:12	–	cgr
Circl	CVE-2024-9052	20 Mar 202511:40	–	circl
CNNVD	编号撤回	20 Mar 202500:00	–	cnnvd
CVE	CVE-2024-9052	20 Mar 202510:09	–	cve
Cvelist	CVE-2024-9052	20 Mar 202510:09	–	cvelist
EUVD	EUVD-2025-6864	3 Oct 202520:07	–	euvd
Github Security Blog	vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object	20 Mar 202512:32	–	github
NVD	CVE-2024-9052	20 Mar 202510:15	–	nvd
OSV	CGA-8W63-2Q64-WM35	31 Mar 202516:02	–	osv
OSV	CGA-PR2F-CP78-V5JH	29 Jan 202600:49	–	osv

Vulners

Node

vllm vllmRange0.0.1–0.8.1python

vllm vllmMatch0.0.1python

vllm vllmMatch0.1.0python

vllm vllmMatch0.1.1python

vllm vllmMatch0.1.2python

vllm vllmMatch0.1.3python

vllm vllmMatch0.1.4python

vllm vllmMatch0.1.5python

vllm vllmMatch0.1.6python

vllm vllmMatch0.1.7python

vllm vllmMatch0.2.0python

vllm vllmMatch0.2.1python

vllm vllmMatch0.2.1.post1python

vllm vllmMatch0.2.2python

vllm vllmMatch0.2.3python

vllm vllmMatch0.2.4python

vllm vllmMatch0.2.5python

vllm vllmMatch0.2.6python

vllm vllmMatch0.2.7python

vllm vllmMatch0.3.0python

vllm vllmMatch0.3.1python

vllm vllmMatch0.3.2python

vllm vllmMatch0.3.3python

vllm vllmMatch0.4.0python

vllm vllmMatch0.4.0.post1python

vllm vllmMatch0.4.1python

vllm vllmMatch0.4.2python

vllm vllmMatch0.4.3python

vllm vllmMatch0.5.0python

vllm vllmMatch0.5.0.post1python

vllm vllmMatch0.5.1python

vllm vllmMatch0.5.2python

vllm vllmMatch0.5.3python

vllm vllmMatch0.5.3.post1python

vllm vllmMatch0.5.4python

vllm vllmMatch0.5.5python

vllm vllmMatch0.6.0python

vllm vllmMatch0.6.1python

vllm vllmMatch0.6.1.post1python

vllm vllmMatch0.6.1.post2python

vllm vllmMatch0.6.2python

vllm vllmMatch0.6.3python

vllm vllmMatch0.6.3.post1python

vllm vllmMatch0.6.4python

vllm vllmMatch0.6.4.post1python

vllm vllmMatch0.6.5python

vllm vllmMatch0.6.6python

vllm vllmMatch0.6.6.post1python

vllm vllmMatch0.7.0python

vllm vllmMatch0.7.1python

vllm vllmMatch0.7.2python

vllm vllmMatch0.7.3python

vllm vllmMatch0.8.0python

Source	Link
github	www.github.com/github/advisory-database/pull/5444
github	www.github.com/vllm-project/vllm/blob/v0.8.1/vllm/distributed/parallel_state.py
github	www.github.com/vllm-project/vllm/blob/32e7db25365415841ebc7c4215851743fbb1bad1/vllm/distributed/parallel_state.py
huntr	www.huntr.com/bounties/ea75728f-4efe-4a3d-9f53-33f2c908e9f8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-9052
github	www.github.com/vllm-project/vllm

13 Dec 2025 07:56Current

8.6High risk

Vulners AI Score8.6

vulnerability remote code execution unsafe deserialization pickle.loads() attacker code execution