Skip to content
fr Sign in
9.8 Critical

CVE-2024-9053 vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints

Description

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.

Affected products and versions

Product Affected versions Fixed in
vllm-project/vllm Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vllm-project/vllm

The 4 CVEs of vllm-project/vllm →
CVE-2026-5497 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded… 7.5 High CVE-2026-4944 vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in… 8.8 High CVE-2024-11041 vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function 9.8 Critical
Track this CVE