CVE-2025-32444: Vllm Vllm RCE Vulnerability

CVE-2025-32444 Overview

CVE-2025-32444 is a critical remote code execution vulnerability affecting vLLM, a high-throughput and memory-efficient inference and serving engine for Large Language Models (LLMs). The vulnerability exists in the mooncake integration component, where pickle-based serialization is used over unsecured ZeroMQ sockets, allowing attackers to execute arbitrary code on vulnerable systems.

Critical Impact
Remote attackers can achieve arbitrary code execution on vLLM instances using the mooncake integration by sending malicious pickle payloads over network-exposed ZeroMQ sockets without any authentication.

Affected Products

vLLM versions 0.6.5 through 0.8.4 (with mooncake integration enabled)
vLLM instances with ZeroMQ sockets exposed to untrusted networks
Deployments using the mooncake_pipe.py distributed KV transfer component

Discovery Timeline

2025-04-30 - CVE-2025-32444 published to NVD
2025-05-28 - Last updated in NVD database

Technical Details for CVE-2025-32444

Vulnerability Analysis

This vulnerability stems from the dangerous combination of insecure deserialization via Python's pickle module and improper network exposure of ZeroMQ communication sockets. The mooncake integration in vLLM uses pickle serialization to transfer data between distributed components through ZeroMQ sockets. These sockets were configured to listen on all network interfaces (0.0.0.0), making them accessible from any network that can reach the vulnerable host.

Python's pickle module is inherently unsafe when processing untrusted data, as it can execute arbitrary code during the deserialization process. An attacker with network access to the vulnerable ZeroMQ endpoints can craft a malicious pickle payload that executes arbitrary commands when deserialized by the vLLM process. This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data).

Root Cause

The root cause is the use of pickle-based serialization for inter-process communication over network sockets without proper authentication or input validation. The vulnerable code in mooncake_pipe.py deserializes incoming data from ZeroMQ sockets using pickle without verifying the source or contents, creating a direct path for remote code execution. Additionally, the sockets were bound to all network interfaces rather than localhost, significantly expanding the attack surface.

Attack Vector

The attack vector is network-based, requiring the attacker to have network connectivity to the ZeroMQ ports used by the mooncake integration. The attack requires no authentication or user interaction. An attacker can:

Identify vLLM instances with exposed ZeroMQ sockets
Craft a malicious pickle payload containing arbitrary Python code
Send the payload to the vulnerable socket
Achieve code execution in the context of the vLLM process

The following patch demonstrates the fix implemented to address this vulnerability:

python

 
 import json
 import os
+import struct
 from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass
 from typing import Optional, Union

Source: GitHub Commit

The security patch replaces the unsafe pickle serialization with safe serialization methods and addresses the ZeroMQ socket configuration to prevent unauthorized access.

Detection Methods for CVE-2025-32444

Indicators of Compromise

Unexpected network connections to ZeroMQ ports used by vLLM mooncake integration
Anomalous process spawning from vLLM Python processes
Unusual pickle deserialization errors in vLLM logs indicating malformed attack payloads
Network traffic containing pickle protocol markers (opcodes like \\x80\\x05) on ZeroMQ channels

Detection Strategies

Monitor network traffic for connections to ZeroMQ ports from unexpected source addresses
Implement network segmentation to isolate vLLM inference infrastructure
Deploy intrusion detection rules to identify pickle protocol traffic on non-standard ports
Audit running vLLM instances for mooncake integration configuration and version

Monitoring Recommendations

Enable comprehensive logging for vLLM distributed components
Monitor process execution chains originating from Python/vLLM processes
Track network socket bindings to identify services listening on 0.0.0.0
Implement file integrity monitoring on vLLM installation directories

How to Mitigate CVE-2025-32444

Immediate Actions Required

Upgrade vLLM to version 0.8.5 or later immediately
If upgrade is not immediately possible, disable mooncake integration until patching is complete
Implement network-level controls to restrict access to ZeroMQ ports used by vLLM
Audit firewall rules to ensure vLLM communication ports are not exposed to untrusted networks

Patch Information

The vulnerability has been addressed in vLLM version 0.8.5. The fix replaces unsafe pickle serialization with secure alternatives and corrects the ZeroMQ socket binding configuration. Organizations should update to the patched version using their standard package management process. The security patch is available at commit a5450f11c95847cf51a17207af9a3ca5ab569b2c. Additional details are available in the GitHub Security Advisory GHSA-hj4w-hm2g-p6w5.

Workarounds

Disable mooncake integration if not required for your deployment
Implement network-level firewall rules to block external access to ZeroMQ ports
Deploy vLLM in network-isolated environments without direct internet exposure
Use VPN or private networking for distributed vLLM deployments

bash

# Configuration example - Restrict ZeroMQ port access via iptables
# Block external access to common ZeroMQ ports used by mooncake
iptables -A INPUT -p tcp --dport 5555:5560 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 5555:5560 -j DROP

# Verify vLLM version
pip show vllm | grep Version
# Expected output for patched version: Version: 0.8.5 or higher