Skip to content
vLLMGHSA-5vqr-wprc-cpp7

vLLM Deserialization of Untrusted Data vulnerability

Critical9.8CVE-2024-11041 · Published Mar 20, 2025 · updated Aug 7, 2026

GitHub advisory

Affected versions

PackageAffectedFixed in
vllm
PyPI
<= 0.6.2No fix yet
Details and references

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.

CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
CVE-2024-11041, PYSEC-2026-566

More vLLM advisories

All vLLM
DateAdvisory
Mar 192025vLLM Allows Remote Code Execution via Mooncake Integration
CVE-2025-29783Critical9.0fixed in 0.8.0
Mar 192025vLLM denial of service via outlines unbounded cache on disk
CVE-2025-29770Medium6.5fixed in 0.8.0
Mar 202025vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
CVE-2024-9053Critical9.8no fix yet
Mar 202025vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
CVE-2024-9052Critical9.8no fix yet
Apr 152025vLLM vulnerable to Denial of Service by abusing xgrammar cache
GHSA-hf3c-wxg2-49q9Medium6.5fixed in 0.8.4
Apr 232025CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0
GHSA-ggpf-24jw-3fcwCritical9.8fixed in 0.8.0

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.