En resumen
- CVE-2024-9053 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a vllm, vllm (vllm-project).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 72.1% de las vulnerabilidades.
- Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.
| Package | Affected versions | Patched versions |
|---|
| vllm PyPI | ≤ 0.6.0
| No fix yet |
| vllm | = 0.6.0
| No fix yet |
Description
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
NVD description
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free