CVE-2026-25960

Katalog CVE

CVSS 9.8 · Critical EPSS 0,75%

Kerentanan Server-Side Request Forgery (SSRF) pada vllm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

21 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)
CWE-474: Use of Function with Inconsistent Implementations

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-v359-jj2v-j536 exploit · patch · advisory vendor
• https://github.com/vllm-project/vllm/commit/6f3b2047abd4a748e3db4a68543f8221358002c0 patch
• https://github.com/vllm-project/vllm/pull/34743 issue tracking · patch
• https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc not applicable
• https://access.redhat.com/errata/RHSA-2026:24977
• https://access.redhat.com/errata/RHSA-2026:42644
• https://access.redhat.com/security/cve/CVE-2026-25960
• https://bugzilla.redhat.com/show_bug.cgi?id=2445892
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25960.json