Inference infrastructure

CVE-2025-30165 affects vLLM's V0 engine in multi-node deployments that use tensor parallelism. Secondary hosts subscribe to the primary host's XPUB socket over ZeroMQ and deserialize received data with pickle, which can be abused to execute code on a remote machine. The flaw is an escalation point if the primary host is compromised, and it can also be reached without primary-host access, for example through ARP cache poisoning. The V1 engine is not affected.

CVE-2025-30202 affects vLLM versions from 0.5.2 up to but not including 0.8.5 in multi-node deployments. The primary host binds an XPUB ZeroMQ socket to all interfaces, so any client with network access can connect unless a firewall blocks the port, and receives the internal vLLM state broadcast to secondary hosts. Connecting repeatedly without reading the published data can slow or block the publisher, causing denial of service.

CVE-2025-0317 affects ollama/ollama versions <=0.3.14. A malicious user who can upload and create a customized GGUF model file on the Ollama server can trigger a division by zero error in the ggufPadding function. The server then crashes, resulting in a Denial of Service (DoS) attack. The weakness is classified as CWE-369 (Divide By Zero).

CVE-2025-0315 affects ollama/ollama versions up to and including 0.3.14. A malicious user can craft a customized GGUF model file, upload it to the Ollama server, and create it, causing the server to allocate unlimited memory. The result is a Denial of Service (DoS) condition, classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

CVE-2025-0312 affects ollama/ollama versions <=0.3.14. A malicious user can craft a customized GGUF model file that, when uploaded and created on the Ollama server, triggers an unchecked null pointer dereference (CWE-476). The crash enables a Denial of Service attack over the remote network.

CVE-2024-8063 is a divide by zero flaw (CWE-369) in ollama/ollama version v0.3.3. It is triggered when GGUF models are imported with a crafted type for `block_count` in the Modelfile. The server crashes when it processes such a model, causing a denial of service (DoS).

CVE-2024-12055 affects Ollama versions <=0.3.14. A malicious user can create a customized gguf model file and upload it to the public Ollama server. When the server processes the malicious model, it crashes, causing a Denial of Service (DoS). The root cause is an out-of-bounds read in the gguf.go file (CWE-125).

CVE-2024-12886 affects the Ollama server in the Go module github.com/ollama/ollama, versions <= 0.3.14. A malicious API server can send a gzip bomb HTTP response, which causes an Out-Of-Memory condition and crashes the Ollama server. The flaw sits in the makeRequestWithRetry and getAuthorizationToken functions, which read the response body with io.ReadAll.

CVE-2025-24357 affects vLLM, a library for LLM inference and serving. In vllm/model_executor/weight_utils.py, the hf_model_weights_iterator function loads model checkpoints downloaded from Hugging Face using torch.load with weights_only defaulting to False. When torch.load loads malicious pickle data, it executes arbitrary code during unpickling. The weakness is classified as CWE-502, Deserialization of Untrusted Data.