{"data":{"id":"97c493ed-868b-4e5f-a348-b0828eb14c7c","title":"CVE-2025-47277: vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4…","summary":"vLLM versions 0.6.5 through 0.8.4 are affected by CVE-2025-47277, but only when the PyNcclPipe KV cache transfer integration is used with the V0 engine. PyTorch's TCPStore listens on all interfaces by default, so the address passed via --kv-ip did not restrict exposure as intended, leaving the PyNcclPipe communication interface reachable beyond the private network.","solution":"Fixed in 0.8.5, which limits the TCPStore socket to the private interface configured via --kv-ip.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-47277","publishedAt":"2025-05-20T22:15:46.730Z","cveId":"CVE-2025-47277","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vllm@>= 0.6.5, < 0.8.5 (fixed: 0.8.5)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM PyNcclPipe KV cache transfer exposed on all network interfaces","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00964,"epssCheckedAt":"2026-11-04T12:08:34.339Z","kevDateAdded":null,"advisoryAliases":["GHSA-hjq4-87xh-g4fv"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:45.214Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-04-28T23:59:40.401Z","daysToFix":-22,"fixCheckedAt":"2026-10-29T21:44:29.040Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.8.5","matchedVersion":"0.8.5","fixReleasedAt":"2025-04-28T23:59:40.401Z","daysToFix":-22,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:28.889Z"}]}}