Description (CNA)
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vllm-project / vllm | affected >= 0.15.1, < 0.17.0 |
CWE
CWE-918
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-v359-jj2v-j536
- https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc
- https://github.com/vllm-project/vllm/pull/34743
- https://github.com/vllm-project/vllm/commit/6f3b2047abd4a748e3db4a68543f8221358002c0
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A remote attacker can exploit this Server-Side Request Forgery (SSRF) bypass vulnerability in the `load_from_url_async` method. The flaw occurs because the URL validation and the actual HTTP request handling use different parsing libraries, leading to inconsistencies. This allows an attacker to bypass existing SSRF protections, potentially leading to the disclosure of sensitive information from internal network resources.