NIXPKGS-2026-0597

GitHub issue published on

Permalink CVE-2026-25960

7.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 2 months ago by @mweinelt Activity log

Created suggestion 2 months ago
@mweinelt ignored
4 packages
- pkgsRocm.vllm
- python312Packages.vllm
- python313Packages.vllm
- pkgsRocm.python3Packages.vllm
2 months ago
@mweinelt accepted 2 months ago
@mweinelt published on GitHub 2 months ago

SSRF Protection Bypass in vLLM

vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.

References

https://github.com/vllm-project/vllm/security/advisories/GHSA-v359-jj2v-j536 x_refsource_CONFIRM
https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc x_refsource_MISC
https://github.com/vllm-project/vllm/pull/34743 x_refsource_MISC
https://github.com/vllm-project/vllm/commit/6f3b2047abd4a748e3db4a68543f8221358002c0 x_refsource_MISC

Affected products

vllm

==>= 0.15.1, < 0.17.0