CVE-2026-25960: SSRF Protection Bypass in vLLM
Vulnerability summary
CVE-2026-25960 is a critical (CVSS 9.8) Server-Side Request Forgery (SSRF) vulnerability in vllm-project vllm. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 09-03-2026PublishedVulnerability first disclosed.
- 21-07-2026Last modifiedVulnerability information updated.
Description
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing. This vulnerability in 0.17.0.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA7.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:LDiffers
- OSV · PypiEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:LDiffers
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
Increase +0.20 pp
From 0.54% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundVllm
Maturity: poc
Weaknesses
CWE · root cause- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- CWE-474Use of Function with Inconsistent ImplementationsThe code uses a function that has inconsistent implementations across operating systems and versions.
Affected systems
PyPI1 product
- vllm≥ 0.15.1, < 0.17.0
Vllm1 product
- vllm≥ 0.15.1, < 0.17.0
Vllm-project1 product
- vllm≥ 0.15.1, < 0.17.0
3 vendors · 3 products
References
14 links- github.com/vllm-project/vllm/security/advisories/GHSA-v359-jj2v-j536X Refsource CONFIRMWEBExploitPatchVendor Advisory
- github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfcX Refsource MISCWEBNot Applicable
- github.com/vllm-project/vllm/commit/6f3b2047abd4a748e3db4a68543f8221358002c0X Refsource MISCWEBPatch
Show all 14 references
- github.com/vllm-project/vllmPACKAGE