{
 "id": "AIR-2025-0276",
 "slug": "cve-2025-30202-data-exposure-via-zeromq-in-multi-node-vllm-d",
 "title": "CVE-2025-30202: Data Exposure via ZeroMQ in Multi-Node vLLM Deployment",
 "summary": "Multi-node vLLM deployments exposed an unauthenticated ZeroMQ socket on all interfaces, allowing arbitrary network clients to receive internal state data. Network restrictions or firewall rules were required to secure affected instances.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "data_leak"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "vLLM"
 ],
 "incident_date": "2025-04-29",
 "incident_date_precision": "day",
 "first_reported": "2025-04-29",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-9f8f-2vmf-885j",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2025-30202: Data exposure via ZeroMQ on multi-node vLLM deployment",
   "published_at": "2025-04-29"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30202",
   "publisher": "NVD",
   "title": "CVE-2025-30202: vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs.",
   "published_at": "2025-04-30"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2025-30202",
  "zeromq",
  "data-exposure"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}