CVE-2025-30202: Data Exposure via ZeroMQ in Multi-Node vLLM Deployment

# CVE-2025-30202: Data Exposure via ZeroMQ in Multi-Node vLLM Deployment

https://gcdradar.vercel.app/incidents/cve-2025-30202-data-exposure-via-zeromq-in-multi-node-vllm-d · AIR-2025-0276 · closed 2025-04-29

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-04-29
- AI role: Attack on AI
- Products: vLLM
- CVE ids: CVE-2025-30202
- CVSS: 7.5

## Summary

Multi-node vLLM deployments exposed an unauthenticated ZeroMQ socket on all interfaces, allowing arbitrary network clients to receive internal state data. Network restrictions or firewall rules were required to secure affected instances.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-04-30: CVE-2025-30202: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. (https://nvd.nist.gov/vuln/detail/CVE-2025-30202)
- 2025-04-29: CVE-2025-30202: Data exposure via ZeroMQ on multi-node vLLM deployment (https://github.com/advisories/GHSA-9f8f-2vmf-885j)

## Sources

- 2025-04-29 GitHub Advisory Database: CVE-2025-30202: Data exposure via ZeroMQ on multi-node vLLM deployment https://github.com/advisories/GHSA-9f8f-2vmf-885j
- 2025-04-30 NVD: CVE-2025-30202: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. https://nvd.nist.gov/vuln/detail/CVE-2025-30202

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.