CVE-2026-25960Medium· 5.4▾ SunlitvLLM has SSRF Protection Bypass
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.6%
The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client.
vllm/connections.pyload_from_url_asyncThe SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing.
These two URL parsers handle backslash characters (\) differently:
| Parser | Input URL | Parsed Host | Parsed Path | Behavior |
|---|---|---|---|---|
urllib3.parse_url() | https://httpbin.org\@evil.com/ | httpbin.org | /%[email protected]/ | URL-encodes \ as %5C, treats \@evil.com/ as part of the path |
yarl (via aiohttp) | https://httpbin.org\@evil.com/ | evil.com | / | Treats \ as part of userinfo (user: httpbin.org\), the @ acts as the userinfo/host separator |
# Attacker provides this URL
malicious_url = "https://httpbin.org\\@evil.com/"
# 1. Validation layer (urllib3.parse_url)
parsed = urllib3.util.parse_url(malicious_url)
# parsed.host == "httpbin.org" ✅ Passes validation
# 2. Actual request (aiohttp with yarl)
async with aiohttp.ClientSession() as session:
async with session.get(malicious_url) as response:
# Request actually goes to evil.com! ❌ Bypass!
httpbin.org\ as the userinfo component, and @ as the userinfo/host separator, so the URL is parsed as user=httpbin.org\, host=evil.com, path=/%5C, so \@evil.com/ becomes /%[email protected]/ which is treated as part of the path, leaving host=httpbin.orgThis inconsistency allows an attacker to:
vllm >= 0.15.1, < 0.17.0Upgrade to a patched release:
vllm 0.17.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-24779High· 7.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-69147Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-57173Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-73558Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-73560Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-71486Medium· 4.3vLLM is an inference and serving engine for large language models