CVE-2025-30202: vLLM denial of service and data exposure via ZeroMQ on multi-node deployment

Summary

CVE-2025-30202 affects vLLM versions from 0.5.2 up to but not including 0.8.5 in multi-node deployments. The primary host binds an XPUB ZeroMQ socket to all interfaces, so any client with network access can connect unless a firewall blocks the port, and receives the internal vLLM state broadcast to secondary hosts. Connecting repeatedly without reading the published data can slow or block the publisher, causing denial of service.

Mitigation

Fixed in 0.8.5.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• vllmPyPILLM dependency since 2023-08-25 · 15 tracked dependents

Topics

• Inference infrastructure

Related items

• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement StudySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence