CVE-2025-32444criticalCode execution2025-04-29
CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake Integration
vLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets.
What it is
vLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack.
This is a similar to GHSA - x3m8 - f7g5 - qhm7, the problem is in
https://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de3008063569b43c5/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L179
How to check
- Affected: vllm (pip) >= 0.6.5, < 0.8.5.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade vllm to 0.8.5 or later.
pip show vllm | grep VersionSources
More advisories for this tool