All vulnerabilities

Servers and applications

CVE-2025-30202

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial of service and data exposure via ZeroMQ on multi-node vLLM deployment. In a multi-node vLLM deployment, vLLM uses ZeroMQ for some multi-node communication purposes. The primary vLLM host opens an XPUB ZeroMQ socket and binds it to ALL…

Severity
High 7.5
Published
30 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
0.8.5
Sources
NVD

Affected software

SoftwareAffected versions
vLLMServers and applications · cpe:a:vllm:vllm
  • From 0.5.2 before 0.8.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-30202
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-30202