vLLM Mooncake Pickle Deserialization RCE
- Product
- vLLM vLLM
- CVE
- CVE-2025-32444
- Disclosed
- 2025-04-30
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- vLLM >= 0.6.5, < 0.8.5 with Mooncake integration
- Fixed
- 0.8.5
Summary
vLLM's Mooncake KV-cache transfer integration accepted Python pickles over ZeroMQ sockets bound to all interfaces. Any network attacker could send a pickle and run code on the inference server.
Root cause
mooncake_pipe.py used pickle-based serialization (recv_pyobj) over unauthenticated ZeroMQ sockets that listened on 0.0.0.0. Unpickling attacker-controlled bytes invokes arbitrary callables via __reduce__.
Impact
Unauthenticated remote code execution on GPU inference nodes.
Detection
Check vLLM version and whether Mooncake disaggregated prefill is enabled; scan for exposed ZeroMQ ports used by KV transfer.
Mitigation
Upgrade to 0.8.5+, and isolate inter-node KV transfer traffic on a private network.