LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

影響: pip:lmcache >= 0.3.9, < 0.5.6 → 0.5.6 Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open this port. The transp…

GitHub Advisory Databaseで読む