CVE-2025-32444

描述

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack. vLLM instances that do not make use of the mooncake integration are not vulnerable. This issue has been patched in version 0.8.5.

如何修補 CVE-2025-32444

要修補 CVE-2025-32444,請將受影響套件升級到下列已修補版本。

• —升級至 0.8.5 或更新版本
• —升級至 a5450f11c95847cf51a17207af9a3ca5ab569b2c 或更新版本

CVE-2025-32444 正在被利用嗎?

低 — EPSS 為 1.5%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 0.6.5, < 0.8.5
• from 0, < a5450f11c95847cf51a17207af9a3ca5ab569b2c | >= 0.6.5, < 0.8.5

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-hj4w-hm2g-p6w5
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-32444
• PATCHgithub.com/vllm-project/vllm
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2025-42.yaml