Log in Start free

Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M

CVE-2026-25960SSRF Protection Bypass in vLLM

High 7.1

In plain English

A high-severity server-side request forgery in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.6%top 50.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIvllm0.17.0GHSA-v359-jj2v-j536
PyPIvllm0.17.0PYSEC-2026-3411

Affected products (as reported)

VendorProductVersions
vllm-project vllm >= 0.15.1, < 0.17.0

Weakness: CWE-918, CWE-474 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

References