CVE-2024-9052
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
CVE-2024-9052 has been rejected by its source and should not be treated as a live vulnerability, published March 20, 2025.
- Severity
- 9.8 CriticalCVSS 3.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vllmPyPI | through 0.8.1 | None known |
vllmPyPI | through 0.8.1, plus listed versions 0.0.10.1.00.1.10.1.20.1.3 Show 45 moreShow less0.1.40.1.50.1.60.1.70.2.00.2.10.2.1.post10.2.20.2.30.2.40.2.50.2.60.2.70.3.00.3.10.3.20.3.30.4.00.4.0.post10.4.10.4.20.4.30.5.00.5.0.post10.5.10.5.20.5.30.5.3.post10.5.40.5.50.6.00.6.10.6.1.post10.6.1.post20.6.20.6.30.6.3.post10.6.40.6.4.post10.6.50.6.60.6.6.post10.7.00.7.10.7.2 | None known |
What each source reports
GitHub Advisories Score usedGHSA-pgr7-mhp5-fgjp
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.
Maintainer perspective
Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.
- Record
GHSA-pgr7-mhp5-fgjp- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-9052- Updated
- 2026-11-02
EUVDEUVD-2025-6864
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
EUVD-2025-6864- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-9052- Updated
- 2026-11-02
OSVGHSA-pgr7-mhp5-fgjp
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.
Maintainer perspective
Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.
- Record
GHSA-pgr7-mhp5-fgjp- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVPYSEC-2026-568
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.
Maintainer perspective
Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.
- Record
PYSEC-2026-568- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
nvd.nist.gov/vuln/detail/CVE-2024-9052
huntr.com/bounties/ea75728f-4efe-4a3d-9f53-33f2c908e9f8
github.com/vllm-project/vllm/blob/32e7db25365415841ebc7c4215851743fbb1bad1/vllm/distributed/parallel_state.py
pypi.org/project/vllm
Left out here: 2 versions. The JSON record has them.