logo_clicknbuy.png

CVE-2025-32444 – “vLLM Mooncake ZeroMQ Remote Code Execution”

The following table lists the changes that have been made to the
CVE-2025-32444 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by [email protected]

    Apr. 30, 2025

    Action Type Old Value New Value
    Added Description vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack. vLLM instances that do not make use of the mooncake integration are not vulnerable. This issue has been patched in version 0.8.5.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added CWE CWE-502
    Added Reference https://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de3008063569b43c5/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L179
    Added Reference https://github.com/vllm-project/vllm/commit/a5450f11c95847cf51a17207af9a3ca5ab569b2c
    Added Reference https://github.com/vllm-project/vllm/security/advisories/GHSA-hj4w-hm2g-p6w5
    Added Reference https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7
Share the Post:

Related Posts