vllm - 💡(How to fix) Fix [Installation]: Blocked by CVE-2025-30165 & CVE-2024-11041 (Legacy V0 Engine)

Your current environment

Summary: Enterprise security scanners (SonarQube, Snyk, Prisma) are currently flagging vLLM (including the latest v0.22.1) with Critical/High vulnerabilities due to the presence of the V0 engine’s pickle implementation in the distribution package.

Details:

• CVE-2025-30165: Remote Code Execution (RCE) via ZeroMQ multi-node communication.

• CVE-2024-11041: Remote Code Execution (RCE) via MessageQueue.dequeue().

These vulnerabilities are detected even when the V1 engine is used by default, as the vulnerable code from the V0 engine remains present in the package. This prevents vLLM from passing security gates in regulated environments.

Impact: vLLM cannot be deployed in environments with strict security requirements. The presence of vulnerable code, even if unused, is a blocker for compliance. Request:

Please consider removing or isolating the vulnerable V0 engine code from the distribution package, or provide guidance on how to exclude it to ensure compliance with enterprise security standards.

How you are installing vllm

pip install -vvv vllm

Before submitting a new issue...

• Make sure you already searched for relevant issues, and asked the chatbot living at the bottom right corner of the documentation page, which can answer lots of frequently asked questions.