Database/AI/ML frameworks & serving
vLLM (`AsyncEngineRPCServer`): Unsafe deserialization on RPC entrypoints
CVSS 9.8CVE-2024-9053AI/ML frameworks & servingcurated
Impact
Unsafe deserialization on RPC entrypoints → RCE
Who can reach it
Unauthenticated network to the RPC server port
What to do
Upgrade past 0.6.0
References
Related entries
- BentoML (runner server): Deserialization RCE on the internal runner serverCVE-2024-9070 · BentoML (runner server)Critical
- MLflow (auth): Weak password requirementsCVE-2025-11200 · MLflow (auth)Critical
- MLflow (model creation): Directory traversal on model creationCVE-2025-11201 · MLflow (model creation)Critical
- MLflow (serving container init): Command injection in `_install_model_dependencies`CVE-2025-15379 · MLflow (serving container init)Critical
- Keras (`Model.load_model`): Arbitrary code execution from a crafted `.keras` archive even with `safe_mode=True`CVE-2025-1550 · Keras (`Model.load_model`)Critical
- LlamaIndex (vector store integrations): SQL injection across multiple vector store integrationsCVE-2025-1793 · LlamaIndex (vector store integrations)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.