CVE-2025-29783 - CVE House

Back to Database

Status published Critical CVE-2025-29783

vLLM Allows Remote Code Execution via Mooncake Integration

9.1 CVSS

Vulnerability Description

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts. This vulnerability is fixed in 0.8.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-29783

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from vllm-project

View All →

vLLM vulnerable to remote code execution via transformers_utils/get_config

vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`

vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs

VLLM deserialization vulnerability leading to DoS and potential RCE

vLLM vulnerable to timing attack at bearer auth

Affected Vendor

vllm-project

View all reports →

Affected Software

vllm

Vulnerable Versions:

>= 0.6.5, < 0.8.0

Timeline

Official Publish: March 19th, 2025

Last Modified: March 22nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1068 Exploitation for Privilege Escalation

Privilege Escalation