CVE-2024-11041

NONE EPSS 69.3%

Published Mar 20, 20251y ago · Modified Jun 17, 20261w ago

Published Mar 20, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.

Threat Intelligence

EPSS Exploit Probability

69.3% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

Affected Products 1

Vendor	Product	Version	Range
vllm	vllm	0.6.2	any

References 1

huntr.com https://huntr.com/bounties/00136195-11e0-4ad0-98d5-72db066e867f

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.