- Description
- vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts. This vulnerability is fixed in 0.8.0.
- Source
- security-advisories@github.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 9
- Impact score
- 6
- Exploitability score
- 2.3
- Vector string
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- security-advisories@github.com
- CWE-502
- Hype score
- Not currently trending
🚨 A critical RCE vulnerability (CVE-2025-29783) has been identified in vLLM's Mooncake integration, earning a CVSS score of 10. Users must update to vLLM 0.8.0 immediately. Full details & mitigation ⬇️ #CyberSecurity #RCE #AI #MachineLearning 🔗 https://t.co/UVRKxqlcrh
@threatsbank
25 Mar 2025
9 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Lessons from CVE-2025-29783: 1) AI attack surface continues to expand with new features and infra 2) pickle is used in ML for more than models 3) dev moves fast; establish standards early to prevent security tech debt 4) traditional appsec tooling is still 🔥 (found w/ @semgrep)
@josephtlucas
23 Mar 2025
706 Impressions
1 Retweet
13 Likes
6 Bookmarks
0 Replies
0 Quotes
CVE-2025-29783: Remote Code Execution in vLLM via Unsafe Deserialization in Mooncake https://t.co/6Zyf4WrPBf
@_cvereports
20 Mar 2025
42 Impressions
0 Retweets
3 Likes
0 Bookmarks
0 Replies
0 Quotes
New post from https://t.co/uXvPWJyEiR (CVE-2025-29783 | vLLM up to 0.7.x ZMQ/TCP deserialization) has been published on https://t.co/Oo3QSqy2Tw
@WolfgangSesin
19 Mar 2025
12 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-29783: CRITICAL] vLLM engine has a remote code execution vulnerability when using Mooncake for distribution. Upgrade to version 0.8.0 to fix this issue on distributed hosts. #cybersecurity#cybersecurity,#vulnerability https://t.co/OR4v579CnY https://t.co/3WkiRnxVwd
@CveFindCom
19 Mar 2025
40 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-29783 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly… https://t.co/N1vrX0EXO1
@CVEnew
19 Mar 2025
254 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes