CVE-2025-29783: Vllm

Critical severity, CVSS 9.0. EPSS: 0.7% chance of exploitation in the next 30 days.

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. When vLLM is configured to use Mooncake, unsafe deserialization exposed directly over ZMQ/TCP on all network interfaces will allow attackers to execute remote code on distributed hosts. This is a remote code execution vulnerability impacting any deployments using Mooncake to distribute KV across distributed hosts. This vulnerability is fixed in 0.8.0.

Affected products

• Vllm Vllm: from 0.6.5, before 0.8.0 (fixed in 0.8.0)

Published 2025-03-19. Last modified 2026-06-17.