vLLM Remote Code Execution via Mooncake Integration (CVE-2025-29783)
vLLM versions 0.6.5 through 0.7.x contained a critical remote code execution vulnerability in the Mooncake integration that used unsafe pickle deserialization on unauthenticated network traffic. The vulnerability was patched in version 0.8.0 by replacing pickle with safetensors serialization.
What happened
vLLM versions 0.6.5 through 0.7.x contain a remote code execution vulnerability in the Mooncake integration, which handles distributed KV cache management across multiple hosts.
The vulnerability stems from unsafe deserialization using pickle.loads() on raw network bytes received via ZMQ/TCP connections without authentication controls, allowing attackers to execute arbitrary code on distributed hosts.
Reported impact
The vulnerability impacts any deployments using Mooncake to distribute KV caches across distributed environments, with a CVSS critical severity score of 9.0.
Index analysis
The recv_tensor() function calls _recv_impl which directly passes raw network bytes to pickle.loads(), and the mooncake pipe is exposed over the network by design using ZMQ over TCP without authentication or access controls.
The vulnerability was resolved in version 0.8.0 by replacing pickle deserialization with safetensors serialization.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.