CVE-2024-11041 — Vulnerability in vllm — CVE Details

CRITICAL

vLLM Deserialization of Untrusted Data vulnerability

Published March 20, 2025Updated August 7, 2026Source: osv

Summary

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.

Advisory Timeline

First published March 20, 2025 (571 days ago).
Last revised August 7, 2026 — 505 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: pypi (1).

Package	Ecosystem	Affected	Fixed In
vllm	pypi	0.0.1, 0.1.0, 0.1.1, 0.1.2 (+36 more)	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-502
Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-11041?: vLLM Deserialization of Untrusted Data vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-11041?: CVE-2024-11041 affects vllm. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-11041 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-5vqr-wprc-cpp7

PYSEC-2026-566

Related CVEs

CVE-2026-22778
CRITICAL
vLLM has RCE In Video Processing
CVE-2025-47277
CRITICAL
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
CVE-2024-9052
CRITICAL
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
CVE-2026-22778
CRITICAL
vLLM has RCE In Video Processing
CVE-2024-9053
CRITICAL
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
CVE-2025-32444
CRITICAL
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
CVE-2025-47277
CRITICAL
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
CVE-2024-9052
CRITICAL
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies