CVE-2024-11041

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.

• CWE-502

• https://huntr.com/bounties/00136195-11e0-4ad0-98d5-72db066e867fExploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11036The The GamiPress – The #1 gamification plugin to reward poi…9.8
• CVE-2024-11037A path traversal vulnerability exists in binary-husky/gpt_ac…6.5
• CVE-2024-11038The The WPB Popup for Contact Form 7 – Showing The Contact F…7.3
• CVE-2024-11039A pickle deserialization vulnerability exists in the Latex E…8.8
• CVE-2024-1104An unauthenticated remote attacker can bypass the brute forc…7.5
• CVE-2024-11040Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER.…
• CVE-2024-11042In invoke-ai/invokeai version v5.0.2, the web API `POST /api…9.1
• CVE-2024-11043A Denial of Service (DoS) vulnerability was discovered in th…7.5
• CVE-2024-11044An open redirect vulnerability in automatic1111/stable-diffu…6.1
• CVE-2024-11045A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in au…9.6
• CVE-2024-11046A vulnerability was found in D-Link DI-8003 16.07.16A1. It h…9.8
• CVE-2024-11047A vulnerability was found in D-Link DI-8003 16.07.16A1. It h…9.8