CVE-2024-9052

✕ Withdrawn — historical dataCRITICALPre-NVD 9.8
9.8CVSS

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.

Maintainer perspective

Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.

CVSS v3
9.8
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

March 20, 2025

Last Modified

March 20, 2025

Frequently asked(4)

What is CVE-2024-9052?
CVE-2024-9052 is a rejected CVE ID: its record was withdrawn on April 10, 2025 and no longer describes a vulnerability. Reason given: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
When was the CVE record for CVE-2024-9052 published?
The CVE record for CVE-2024-9052 was published on March 20, 2025. EchelonGraph's copy of the record carries a last-modified date of March 20, 2025; the record at its source may have been updated since.
What is the CVSS score of CVE-2024-9052?
CVE-2024-9052 has a CVSS base score of 9.8 (the CNA's own assessment, by github_m; NVD's own analysis pending).
How do I remediate CVE-2024-9052?
There is nothing to remediate under CVE-2024-9052: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.