CVE-2025-30165: Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
First published: Tue May 06 2025(Updated: )
### Affected Environments Note that this issue only affects the V0 engine, which has been off by default since v0.8.0. Further, the issue only applies to a deployment using tensor parallelism across multiple hosts, which we do not expect to be a common deployment pattern. Since V0 is has been off by default since v0.8.0 and the fix is fairly invasive, we have decided not to fix this issue. Instead we recommend that users ensure their environment is on a secure network in case this pattern is in use. The V1 engine is not affected by this issue. ### Impact In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node communication purposes. The secondary vLLM hosts open a `SUB` ZeroMQ socket and connect to an `XPUB` socket on the primary vLLM host. https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L295-L301 When data is received on this `SUB` socket, it is deserialized with `pickle`. This is unsafe, as it can be abused to execute code on a remote machine. https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L468-L470 Since the vulnerability exists in a client that connects to the primary vLLM host, this vulnerability serves as an escalation point. If the primary vLLM host is compromised, this vulnerability could be used to compromise the rest of the hosts in the vLLM deployment. Attackers could also use other means to exploit the vulnerability without requiring access to the primary vLLM host. One example would be the use of ARP cache poisoning to redirect traffic to a malicious endpoint used to deliver a payload with arbitrary code to execute on the target machine.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/vllm | >=0.5.2<=0.8.5.post1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vllm-project/vllm/security/advisories/GHSA-9pcc-gvx5-r5wm
- https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L295-L301
- https://github.com/vllm-project/vllm/blob/c21b99b91241409c2fdf9f3f8c542e8748b317be/vllm/distributed/device_communicators/shm_broadcast.py#L468-L470
- https://nvd.nist.gov/vuln/detail/CVE-2025-30165
- https://github.com/advisories/GHSA-9pcc-gvx5-r5wm (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-30165?
The severity of CVE-2025-30165 is not explicitly stated, but it specifically affects the V0 engine used in tensor parallelism deployments.
How do I fix CVE-2025-30165?
To mitigate CVE-2025-30165, avoid using the V0 engine in deployments and ensure you're using a version of vllm that is not affected.
What versions of vllm are affected by CVE-2025-30165?
CVE-2025-30165 affects vllm versions between 0.5.2 and 0.8.5.post1.
What environments are vulnerable to CVE-2025-30165?
CVE-2025-30165 only affects deployments using the V0 engine with tensor parallelism across multiple hosts.
Is CVE-2025-30165 relevant for all vllm users?
No, CVE-2025-30165 is relevant primarily for users employing the tensor parallelism feature with the V0 engine, which is off by default.
- agent/weakness
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/source
- agent/author
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9pcc-gvx5-r5wm
- alias/CVE-2025-30165
- agent/software-canonical-lookup
- collector/nvd-cve
- agent/references
- agent/last-modified-date
- agent/tags
- package-manager/pip