10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32444

CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake Integration

Impacted Deployments

Note that vLLM instances that do NOT make use of the mooncake integration are NOT vulnerable.

Description

vLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack.

This is a similar to GHSA - x3m8 - f7g5 - qhm7, the problem is in

https://github.com/vllm-project/vllm/blob/32b14baf8a1f7195ca09484de3008063569b43c5/vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py#L179

Here recv_pyobj() Contains implicit pickle.loads(), which leads to potential RCE.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32444

CVE-2025-32444:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	>= 0.6.5, < 0.8.5	0.8.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from the use of pickle for deserialization over ZeroMQ sockets, specifically through the recv_pyobj() method. The provided commit a5450f11c95847cf51a17207af9a3ca5ab569b2c patches this vulnerability by replacing recv_pyobj() and send_pyobj() calls with safer alternatives that do not use pickle (e.g., recv(), recv_multipart(), send(), send_multipart() with struct for serialization).

The analysis of the patch in vllm/distributed/kv_transfer/kv_pipe/mooncake_pipe.py reveals two key functions that were modified to remove the usage of recv_pyobj():

MooncakeKVPipe.wait_for_ack: This function previously called self.sender_ack.recv_pyobj().
MooncakeKVPipe.recv_bytes: This function previously called self.receiver_socket.recv_pyobj().

These functions are identified as vulnerable because they directly processed input received via recv_pyobj(), which performs unsafe deserialization using pickle.loads(). An attacker could exploit this by sending a malicious pickled payload, leading to remote code execution when these functions attempt to deserialize it.

The function MooncakeKVPipe.send_bytes was also modified to remove send_pyobj(). While send_pyobj() uses pickle.dumps(), which itself is not an RCE vector on the sender, it's part of the vulnerable communication channel. However, the primary RCE risk lies with recv_pyobj() which deserializes untrusted data.

The changes in _setup_metadata_sockets (binding to specific hosts instead of *) are mitigations to reduce the attack surface but do not address the core deserialization vulnerability itself. The functions wait_for_ack and recv_bytes are where the malicious data would be processed, triggering the RCE.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.