VULNERABILITY INTELLIGENCE
CVE-2025-29783
CVSS score9 CRITICAL
EPSS probability0.73%
CISA KEVNot currently listed
Published2025-03-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts. This vulnerability is fixed in 0.8.0.
Weakness classification
- security-advisories@github.com: CWE-502
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Issue Tracking, Vendor Advisory
- security-advisories@github.com — Vendor Advisory