PT-2025-22278 · Vllm · Vllm

Kikayli

+2

·

Published

2025-04-03

·

Updated

2025-09-23

·

CVE-2025-47277

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions vLLM versions 0.6.5 through 0.8.4
Description vLLM, an inference and serving engine for large language models (LLMs), contains a remote code execution issue. This impacts environments utilizing the PyNcclPipe KV cache transfer integration with the V0 engine. The issue stems from the use of pickle.loads to process client-provided data within the PyNcclPipe implementation, creating an unsafe deserialization vulnerability. An attacker can exploit this by sending malicious serialized data to gain server control privileges. The PyNcclPipe class is used to establish peer-to-peer communication for data transmission between distributed nodes, and the GPU-side KV-Cache transmission is implemented through the PyNcclCommunicator class. CPU-side control message passing is handled via the send obj and recv obj methods. The intended behavior was for this interface to be exposed only to a private network using the IP address specified by the --kv-ip CLI parameter. The default behavior of PyTorch allows the TCPStore interface to listen on all interfaces, regardless of the provided IP address.
Recommendations Update to vLLM version 0.8.5 or later to benefit from the fix that limits the TCPStore socket to the configured private interface.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-03420
CVE-2025-47277
GHSA-HJQ4-87XH-G4FV

Affected Products

Vllm