Skip to content
fr Sign in
9.8 Critical

CVE-2024-11041 vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function

Description

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.

Affected products and versions

Product Affected versions Fixed in
vllm-project/vllm Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vllm-project/vllm

The 4 CVEs of vllm-project/vllm →
CVE-2026-5497 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded… 7.5 High CVE-2026-4944 vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in… 8.8 High CVE-2024-9053 vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints 9.8 Critical
Track this CVE