CVE-2025-29783

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts. This vulnerability is fixed in 0.8.0.

• CWE-502

• https://github.com/vllm-project/vllm/commit/288ca110f68d23909728627d3100e5a8db820aa2Patch
• https://github.com/vllm-project/vllm/pull/14228Issue Tracking, Vendor Advisory
• https://github.com/vllm-project/vllm/security/advisories/GHSA-x3m8-f7g5-qhm7Vendor Advisory

Published

Mar 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-29778Kyverno is a policy engine designed for cloud native platfor…8
• CVE-2025-29779Post-Quantum Secure Feldman's Verifiable Secret Sharing prov…5.4
• CVE-2025-2978A vulnerability was found in WCMS 11. It has been rated as c…9.8
• CVE-2025-29780Post-Quantum Secure Feldman's Verifiable Secret Sharing prov…5.8
• CVE-2025-29781The Bare Metal Operator (BMO) implements a Kubernetes API fo…6.5
• CVE-2025-29782WeGIA is Web manager for charitable institutions A Stored Cr…5.4
• CVE-2025-29784NamelessMC is a free, easy to use & powerful website softwar…7.5
• CVE-2025-29785quic-go is an implementation of the QUIC protocol in Go. The…7.5
• CVE-2025-29786Expr is an expression language and expression evaluation for…7.5
• CVE-2025-29787`zip` is a zip library for rust which supports reading and w…7.3
• CVE-2025-29788The Syliud PayPal Plugin is the Sylius Core Team’s plugin fo…6.5
• CVE-2025-29789OpenEMR is a free and open source electronic health records …7.5