Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34753vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

Medium 5.4

In plain English

A medium-severity server-side request forgery in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. This can be used to target internal services (e.g. cloud metadata endpoints or internal HTTP APIs) reachable from the vLLM host. This vulnerability is fixed in 0.19.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	vllm	0.19.0	GHSA-pf3h-qjgv-vcpr
PyPI	vllm	0.19.0	PYSEC-2026-3410

Affected products (as reported)

Vendor	Product	Versions
vllm-project	vllm	>= 0.16.0, < 0.19.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References

https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr x_refsource_CONFIRM