Em resumo
- CVE-2024-9053 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta vllm, vllm (vllm-project).
- Chance de exploração nos próximos 30 dias (EPSS): 1.4%, maior que 72.1% das vulnerabilidades.
- Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.
| Package | Affected versions | Patched versions |
|---|
| vllm PyPI | ≤ 0.6.0
| No fix yet |
| vllm | = 0.6.0
| No fix yet |
Description
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
NVD description
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free