Executive brief
vLLM is a high-throughput engine for serving large language models. A security flaw in how it handles web addresses allows an attacker to bypass safety filters and force the server to connect to unintended internal or external systems. This could lead to the exposure of sensitive internal data or unauthorized access to private services within the corporate network.
Technical details
A Server-Side Request Forgery (SSRF) bypass exists in vLLM's 'load_from_url_async' function within 'vllm/connections.py'. The vulnerability stems from a differential in how the 'urllib3' library (used for validation) and the 'yarl' library (used by 'aiohttp' for the actual request) parse backslashes in URLs. Specifically, 'urllib3' treats a backslash as part of the path, while 'yarl' may interpret it as part of the userinfo component, allowing an attacker to provide a URL that passes hostname allowlist checks but resolves to a different, malicious host during execution. This allows authenticated users to perform SSRF attacks against internal or external services. The issue is fixed in version 0.17.0.
Affected products
- vllm-project vllm >= 0.15.1, < 0.17.0
Timeline
- 2026-03-09: disclosed
- 2026-03-09: advisory
- 2026-03-09: patched: Fixed in version 0.17.0
References
- https://api.github.com/users/RacerZ-fighting
- https://github.com/RacerZ-fighting
- https://api.github.com/users/RacerZ-fighting/gists%7B/gist_id%7D
- https://api.github.com/users/RacerZ-fighting/repos
- https://avatars.githubusercontent.com/u/78632303?v=4
- https://api.github.com/users/RacerZ-fighting/events%7B/privacy%7D