CVE-2026-25960: SSRF Protection Bypass in vLLM via URL Parsing Inconsistency
CVE-2026-25960 is a server-side request forgery (SSRF) protection bypass in the load_from_url_async method of vLLM. The validation layer uses urllib3 while the HTTP client uses aiohttp with yarl, so the two components can interpret the same URL differently. The record assigns a CVSS 3.1 score of 9.8 from NVD and 7.1 from GitHub, and lists no confirmed exploitation.
Overview
vLLM is an inference and serving engine for large language models. According to the GitHub advisory referenced in the record, the SSRF fix introduced for CVE-2026-24779 in 0.15.1 can be bypassed in the load_from_url_async method. The root cause described is a mismatch between how urllib3 parses a URL during validation and how aiohttp, through yarl, parses it when the request is sent. The weakness is classified as CWE-918, Server-Side Request Forgery.
Impact
- The record describes a bypass of URL validation that could allow user-supplied URLs to reach destinations the protection was meant to block.
- NVD scores the issue 9.8 (critical). GitHub scores it 7.1. The record does not explain the difference between these scores.
- SSVC data in the record indicates exploitation status none, automatable no and partial technical impact.
Affected products and versions
- The record lists the affected range as from 0.15.1 up to but excluding 0.17.0 for the vLLM project.
- The description also states the vulnerability is in 0.17.0, which conflicts with the range above. Confirm the boundary against the GitHub advisory before drawing conclusions.
- The record does not state an explicit fixed release number. Fix-related references include a commit and a pull request.
Exploitation status
- CISA KEV does not list this CVE in the record, so no confirmed active exploitation can be stated from this data.
- No confirmed exploitation appears in the sources consulted. One reference carries an "Exploit" tag, but the record does not describe any observed exploitation.
- SSVC data lists exploitation as none and automatable as no.
Remediation and mitigation
- Review the GitHub security advisory and move to a release that includes the fix, as indicated by the advisory.
- Check vendor advisories from Red Hat for distribution-specific guidance and errata.
- Until patched, limit which callers can supply URLs to load_from_url_async and restrict outbound network access from inference servers to only the destinations they need.
Detection guidance
- Log and review outbound HTTP requests from vLLM hosts, especially requests to internal address ranges, cloud metadata endpoints or unexpected hosts.
- Alert on inference requests that include URLs pointing to private or link-local addresses.
Limitations of the available information
- The record contains conflicting version information: an affected range ending before 0.17.0 and a description that places the vulnerability in 0.17.0.
- The record does not give a precise fixed version number.
- The CVSS scores differ between providers (9.8 from NVD and 7.1 from GitHub) and the reason is not stated.
- No proof-of-concept details are provided in the record, and this analysis does not add any.
Frequently asked questions
What is the root cause of CVE-2026-25960?
According to the record, the validation layer uses urllib3 to parse the URL, while the HTTP client uses aiohttp, which relies on yarl. Because these parsers can read the same URL differently, the validation can be bypassed.
Is this CVE being actively exploited?
The record does not list this CVE in CISA KEV and no confirmed exploitation appears in the sources consulted. SSVC data in the record also lists exploitation as none.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.