CVE-2024-9053: falha crítica em vllm-project/vllm
Remote Code Execution in vllm-project/vllm
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 1.4%
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
vllm-project · vllm-project/vllmCVEs relacionadas — vllm-project/vllm
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11041CRITICALRemote Code Execution in vllm-project/vllmEPSS 1.7%CVE-2026-4944HIGHHardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security ControlEPSS 0.7%CVE-2026-5497HIGHUnbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllmEPSS 0.5%