CVE-2025-47277: 
Chainguard vulnerability analysis and mitigation

CVE-2025-47277 is a critical vulnerability discovered in vLLM (versions 0.6.5 through 0.8.4), a high-performance inference and serving engine for large language models (LLMs). The vulnerability specifically affects environments using the PyNcclPipe KV cache transfer integration with the V0 engine. Disclosed on May 20, 2025, it has been assigned a CVSS score of 9.8, indicating critical severity. The issue involves the PyNcclPipe class implementation, which is used for KV cache transfer between distributed nodes using peer-to-peer messaging (Wiz Security, GitHub Advisory).

The vulnerability exists in the PyNcclPipe class implementation where it directly processes client-provided data using pickle.loads, creating an unsafe deserialization vulnerability. The critical security flaw stems from PyTorch's TCPStore interface default behavior, which causes it to listen on all interfaces regardless of the IP address provided through the --kv-ip CLI parameter. The IP address was only used as a client-side address, contrary to the intended security model where the interface should only be exposed to a private network (GitHub Advisory, Security Guide).

The vulnerability enables remote code execution (RCE) capabilities, allowing attackers to execute arbitrary system commands on the host and potentially gain full control of the server. This poses a significant risk to the confidentiality, integrity, and availability of affected systems. The CVSS score of 9.8 reflects the critical nature of this vulnerability, with high impact ratings across confidentiality, integrity, and availability metrics (Wiz Security, GitHub Advisory).

The vulnerability has been patched in vLLM version 0.8.5, which implements a workaround to force the TCPStore instance to bind its socket to a specified private interface. Users are strongly recommended to update to this version immediately. For those unable to update, it is recommended to deploy vLLM nodes on a dedicated, isolated network and implement appropriate firewall rules to prevent unauthorized access. Additionally, the KV cache transfer in the V0 engine is considered experimental and not recommended for production environments (GitHub Advisory, Security Guide).