Aller au contenu
en Se connecter
9.8 Critique

CVE-2024-11041 vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function

Description

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.

Produits et versions touchés

Produit Versions touchées Corrigé en
vllm-project/vllm Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de vllm-project/vllm

Les 4 CVE de vllm-project/vllm →
CVE-2026-5497 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded… 7.5 Élevée CVE-2026-4944 vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in… 8.8 Élevée CVE-2024-9053 vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints 9.8 Critique
Suivre cette CVE