CVE-2024-9053
CVSS 3.0 Score 9.8 of 10 (critical)
Details
Published Mar 20, 2025
CWE ID 78
Summary
CVE-2024-9053 is a newly disclosed vulnerability affecting the vllm-project vllm version 0.6.0. The issue lies in the AsyncEngineRPCServer() RPC server entrypoints, where the core functionality run_server_loop() calls _make_handler_coro(). This function directly uses cloudpickle.loads() on received messages without proper sanitization. Hackers can exploit this vulnerability by sending malicious pickle data, leading to remote code execution.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.