REDHAT-BUG-2373716: SSRF

Published Jun 18, 2025

Updated

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.

Affected Software

1 affected component

vllm vllm

Event History

Jun 18, 2025

Data Sourced

via Red Hat·03:28 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2373716?

The severity of REDHAT-BUG-2373716 is classified as critical due to its potential for significant impact through Server-Side Request Forgery.

How do I fix REDHAT-BUG-2373716?

To fix REDHAT-BUG-2373716, update to the patched version of the vLLM software that addresses the SSRF vulnerability.

Which versions of vLLM are affected by REDHAT-BUG-2373716?

REDHAT-BUG-2373716 affects all versions of the vLLM software utilizing the MediaConnector class without the necessary restrictions.

What are the potential impacts of REDHAT-BUG-2373716?

The potential impacts of REDHAT-BUG-2373716 include unauthorized access to internal systems and exposure of sensitive data through SSRF attacks.

Is there a workaround for REDHAT-BUG-2373716?

Currently, implementing input validation to restrict URLs accepted by the load_from_url and load_from_url_async methods can serve as a temporary workaround for REDHAT-BUG-2373716.