/
DirectorySecurity Advisories
Sign In
Security Advisories

CVE-2024-9052

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-9052

CGA ID

CGA-v8v2-8wcq-m3j7

Severity

Unknown

Summary

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

Description

vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.

Maintainer perspective

Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.

References

Affected packages


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Products

Chainguard ContainersChainguard LibrariesChainguard VMs