Bug 2355250 (CVE-2025-30165)

Summary: CVE-2025-30165 vllm: Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bbrownin, jeder, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in vLLM's multi-node configuration, which is vulnerable to remote code execution due to unsafe deserialization using pickle over a ZeroMQ SUB socket. If the primary vLLM host is compromised, attackers can escalate privileges and execute arbitrary code on connected secondary hosts.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-03-27 06:31:09 UTC 
In a multi-node deployment of vLLM, the secondary hosts connect to a primary vLLM host via a SUB ZeroMQ socket. Incoming data is deserialized using Python’s pickle, which is inherently unsafe and allows arbitrary code execution. If an attacker compromises the primary vLLM host, they can send malicious payloads to the connected secondary hosts, leading to remote code execution across the cluster. This vulnerability poses a significant risk in distributed environments where vLLM is used for large-scale AI inference.