CVE-2024-9053

Remote Code Execution in vllm-project/vllm

At a glance

Severity: CRITICAL 9.8
EPSS: EPSS 1.38 % · percentile 72 (2026-10-27)
State: PUBLISHED
Published: 2025-03-20
Updated: 2025-10-15
Assigner: @huntr_ai
NVD status: Modified

Description

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.

Scores

Version	Score	Vector	Scored by
CVSS 3.0	CRITICAL 9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	@huntr_ai
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.0	CRITICAL 9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · security@huntr.dev (Secondary)

Weaknesses (CWE)

Advisories

GHSA-cj47-qj6g-x7r4 — vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
PYSEC-2025-222 — vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls th

European references

ENISA EUVD · EUVD-2025-6874
GCVE · GCVE-0-2024-9053

Affected configurations (NVD CPE)

cpe:2.3:a:vllm-project:vllm:0.6.0:*:*:*:*:*:*:*

Affected products

Product	Versions
vllm-project · vllm-project/vllm	affected unspecified ≤ latest

References

https://huntr.com/bounties/75a544f3-34a3-4da0-b5a3-1495cb031e09

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD