CVE-2025-29783: vLLM Allows Remote Code Execution via Mooncake Integration
Summary When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP will allow attackers to execute remote code on distributed hosts.
Details 1. Pickle deserialization vulnerabilities are well documented. 2. The mooncake pipe is exposed over the network (by design to enable disaggregated prefilling across distributed environments) using ZMQ over TCP, greatly increasing exploitability. ~~Further, the mooncake integration opens these sockets listening on all interfaces on the host, meaning it can not be configured to only use a private, trusted network.~~
Only sendersocket and receiverack are allowed to be accessed publicly, while the data actually decompressed by pickle.loads() comes from recvbytes. Its interface is defined as self.receiversocket.connect(f\"tcp://{dhost}:{drankoffset + 1}\"), where dhost is decodehost, a locally defined address 192.168.0.139,from mooncake.json (https://github.com/kvcache-ai/Mooncake/blob/main/doc/en/vllm-integration-v0.2.md?plain=1#L36).
3. The root problem is recvtensor() calls recvimpl which passes the raw network bytes to pickle.loads(). Additionally, it does not appear that there are any controls (network, authentication, etc) to prevent arbitrary users from sending this payload to the affected service.
Impact This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts.
Remediation This issue is resolved by https://github.com/vllm-project/vllm/pull/14228
Other sources
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts. This vulnerability is fixed in 0.8.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.8.0 - Upgrade
Upgrade
vLLM (mooncake integration)to a version that resolves this vulnerability.Fixed in 0.8.0Patch https://github.com/vllm-project/vllm/pull/14228 - Compensating control
Restrict network access to the Mooncake pipe exposed over ZMQ/TCP (the receiver_socket that connects to tcp://192.168.0.139:<d_rank_offset + 1>) so only trusted/distributed hosts can reach it; do not expose the Mooncake/ZMQ/TCP interface to arbitrary users over all network interfaces.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29783?
CVE-2025-29783 has a high severity due to the potential for remote code execution through unsafe deserialization.
How do I fix CVE-2025-29783?
To fix CVE-2025-29783, upgrade to vLLM version 0.8.0 or later where the vulnerability has been addressed.
What systems are affected by CVE-2025-29783?
CVE-2025-29783 affects all versions of vLLM prior to 0.8.0 that are configured to use Mooncake over ZMQ/TCP.
What types of attacks can be executed due to CVE-2025-29783?
Attackers can execute remote code on distributed hosts due to the unsafe deserialization vulnerability in CVE-2025-29783.
Is CVE-2025-29783 limited to specific network interfaces?
CVE-2025-29783 is exposed over all network interfaces when vLLM is used with Mooncake, making it particularly vulnerable.