{
 "id": "AIR-2025-0280",
 "slug": "cve-2025-30165-remote-code-execution-in-vllm-multi-node-clus",
 "title": "CVE-2025-30165: Remote Code Execution in vLLM Multi-Node Cluster Configuration",
 "summary": "A remote code execution vulnerability exists in the V0 engine of vLLM when using tensor parallelism across multiple hosts. Due to the architecture, maintainers recommended running deployments on secure networks rather than issuing a patch.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2025-05-06",
 "incident_date_precision": "day",
 "first_reported": "2025-05-06",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-9pcc-gvx5-r5wm",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2025-30165: Remote Code Execution Vulnerability in vLLM Multi-Node Cluster Configuration",
   "published_at": "2025-05-06"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30165",
   "publisher": "NVD",
   "title": "CVE-2025-30165: vLLM is an inference and serving engine for large language models.",
   "published_at": "2025-05-06"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2025-30165",
  "rce",
  "vllm"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}