REDHAT-BUG-2445892: SSRF
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parseurl() to validate and extract the hostname from user-provided URLs. However, loadfromurlasync uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.15.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2445892?
The severity of REDHAT-BUG-2445892 is high, rated at 7.
How do I fix REDHAT-BUG-2445892?
To fix REDHAT-BUG-2445892, upgrade vLLM to a version that addresses the SSRF bypass vulnerability.
What vulnerability type is associated with REDHAT-BUG-2445892?
REDHAT-BUG-2445892 is associated with Server-Side Request Forgery (SSRF) vulnerabilities.
What implications does REDHAT-BUG-2445892 have for vLLM users?
REDHAT-BUG-2445892 may allow attackers to bypass SSRF protections, potentially leading to unauthorized access to internal resources.
What is the description of REDHAT-BUG-2445892?
REDHAT-BUG-2445892 describes an SSRF protection bypass vulnerability in the load_from_url_async method due to inconsistent URL parsing in vLLM.