{"data":{"id":"2387989b-b211-409d-9c0f-ce08fd7b3175","title":"CVE-2025-30202: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and…","summary":"CVE-2025-30202 affects vLLM versions from 0.5.2 up to but not including 0.8.5 in multi-node deployments. The primary host binds an XPUB ZeroMQ socket to all interfaces, so any client with network access can connect unless a firewall blocks the port, and receives the internal vLLM state broadcast to secondary hosts. Connecting repeatedly without reading the published data can slow or block the publisher, causing denial of service.","solution":"Fixed in 0.8.5.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-30202","publishedAt":"2025-04-30T05:15:51.800Z","cveId":"CVE-2025-30202","cweIds":["CWE-770"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["denial_of_service","data_extraction"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.5.2, < 0.8.5 (fixed: 0.8.5)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM denial of service and data exposure via ZeroMQ on multi-node deployment","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00609,"epssCheckedAt":"2026-11-04T00:12:27.430Z","kevDateAdded":null,"advisoryAliases":["GHSA-9f8f-2vmf-885j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:54.515Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-04-28T23:59:40.401Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:44:36.884Z","capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.8.5","matchedVersion":"0.8.5","fixReleasedAt":"2025-04-28T23:59:40.401Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:36.726Z"}]}}