CVE-2024-11041
Remote Code Execution in vllm-project/vllm
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Remote Code Execution in vllm-project/vllm
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.
Reserved 2024-11-09 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-502 Deserialization of Untrusted Data
huntr.com/bounties/00136195-11e0-4ad0-98d5-72db066e867f
Support options
