CVE-2025-32444: Critical RCE in vLLM Mooncake Integration

CVE-2025-32444 is a critical (CVSS 10.0) remote code execution flaw in vLLM. Versions from 0.6.5 up to but not including 0.8.5 that use the Mooncake integration deserialize pickle data over ZeroMQ sockets listening on all interfaces. The fix is vLLM 0.8.5. Instances without Mooncake are not affected.

What's affected

vLLM versions starting from 0.6.5 and prior to 0.8.5, and only when the Mooncake integration is in use. The CVE record states that vLLM instances which do not use the Mooncake integration are not vulnerable. The issue was patched in version 0.8.5.

The advisory explains why the integration is exposed: the Mooncake pipe is reachable over the network by design, to allow disaggregated prefilling across distributed hosts, and it uses ZeroMQ over TCP. The sockets were set to listen on all network interfaces, so any host that can reach them can send data to them.

The advisory says the key problem is that raw network bytes are passed to pickle.loads. It also says it found no network or authentication controls that stop arbitrary senders. A fix is referenced as pull request 14228.

How to check if you're exposed

Check the installed version of vLLM on every host in the cluster:

pip show vllm

Then find out whether Mooncake is configured. Look for the Mooncake configuration file and for any KV transfer settings that name it in your launch scripts or deployment manifests.

Finally, list listening TCP ports on each node and compare them with what your network policy allows:

ss -ltnp

Any ZeroMQ port from the Mooncake pipe that is reachable from outside the serving cluster is a finding, whatever the version.

What to do now

1. Upgrade vLLM to 0.8.5 or later on all nodes that run the Mooncake integration.
2. If you cannot upgrade yet, stop using the Mooncake integration, or limit its ports so only the other serving nodes can connect.
3. Add firewall or security group rules so these ports are never reachable from user networks or the internet.
4. Check the hosts for signs of misuse if the ports were ever exposed, including unexpected processes and outbound connections.
5. Review other inter-node channels in your AI serving stack for the same pattern of native object formats over a network port.

Why it matters

The class is CWE-502 (Deserialization of Untrusted Data). Python's pickle format can run code while it is being loaded, so loading bytes from a network peer lets that peer run code on your server. That is why the score is at the maximum with a changed scope.

Inference clusters are often treated as internal plumbing, which is how ports like these end up open on all interfaces. The lesson is broader than one project. Anything that moves model or cache data between nodes should use authenticated channels and data-only formats.

The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.

Try it yourself

Only deployments that use the Mooncake integration are affected, which makes this a good example of why reachability matters. This demo shows how reachability analysis separates vulnerable code you run from code that is merely present.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CVE-2025-32444 record on Safeguard Gold
• vLLM security advisory GHSA-x3m8-f7g5-qhm7
• vLLM security advisory GHSA-hj4w-hm2g-p6w5

Last reviewed: 18 October 2026.