CVE-2024-9053 — Deserialization of Untrusted Data in Vllm

CWE-502 — Deserialization of Untrusted DataCWE-78 — OS Command Injection5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
2.2%
top 15.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Vllm-project VllmVllmVllm-project Vllm
Timeline
PublishedMar 20
Latest updateMar 2

Description

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5vllm-project/vllm-project_vllmunspecified — latest
▶PyPIvllm/vllm0.6.0

🔴Vulnerability Details

2
GHSA
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints↗2025-03-20
▶
OSV
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints↗2025-03-20
▶

📋Vendor Advisories

1
Red Hat
vllm: Remote Code Execution in vllm-project/vllm↗2025-03-20
▶

📄Research Papers

1
arXiv
ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense↗2026-03-02
▶