{"data":{"id":"5e0cf75c-d70c-47a0-a234-c72504785fc8","title":"CVE-2025-32444: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and…","summary":"CVE-2025-32444 affects vLLM versions starting from 0.6.5 and prior to 0.8.5 when the vLLM integration with mooncake is in use. Those versions use pickle-based serialization over unsecured ZeroMQ sockets, which are set to listen on all network interfaces, allowing remote code execution by an attacker who can reach them. vLLM instances without the mooncake integration are not vulnerable.","solution":"Fixed in 0.8.5.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-32444","publishedAt":"2025-04-30T05:15:51.953Z","cveId":"CVE-2025-32444","cweIds":["CWE-502"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.6.5, < 0.8.5 (fixed: 0.8.5)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM","mooncake"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM remote code execution through pickle deserialization over ZeroMQ sockets","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0182,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-hj4w-hm2g-p6w5"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:53.929Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-04-28T23:59:40.401Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:44:36.097Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.97,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.8.5","matchedVersion":"0.8.5","fixReleasedAt":"2025-04-28T23:59:40.401Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:35.944Z"}]}}