CVE-2025-6242: vLLM Server-Side Request Forgery (SSRF) Vulnerability in MediaConnector Class
Summary
CVE-2025-6242: vLLM is vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector class. Affects vllm versions >= 0.5.0, < 0.11.0. Fixed in 0.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source project designed for efficient large language model (LLM) management and multimodal capabilities. It allows users to load and process various media types through its MediaConnector class. However, this functionality can be exploited if proper security measures are not implemented, leading to potential SSRF vulnerabilities.
Vulnerability Detail
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources, potentially leading to denial of service or unauthorized access to sensitive data.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.11.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Implement a configurable allowlist or denylist for domains and IP addresses in the MediaConnector class. Below is an example implementation:
# In MediaConnector.__init__
self.allowed_domains = set(config.get("allowed_media_domains", []))
self.denied_ip_ranges = [ip_network(r) for r in PRIVATE_IP_RANGES]
# In MediaConnector.load_from_url
url_spec = urlparse(url)
hostname = url_spec.hostname
if self.allowed_domains and hostname not in self.allowed_domains:
raise ValueError(f"Domain {hostname} is not in the allowed list.")
ip_address = ip_address(socket.gethostbyname(hostname))
if any(ip_address in network for network in self.denied_ip_ranges):
raise ValueError(f"Access to private IP address {ip_address} is forbidden.")
Conclusion
The vLLM package has a critical SSRF vulnerability that can be exploited to access internal resources. Users are strongly advised to update to the patched version 0.11.0 or later and implement additional security measures to mitigate risks.
See every vulnerability recorded for vllm →
FAQ
CVE-2025-6242 is a vulnerability in the vLLM package that allows for Server-Side Request Forgery (SSRF) through the MediaConnector class.
This vulnerability can allow attackers to make arbitrary requests to internal network resources, potentially leading to data leaks or denial of service.
Versions of vLLM prior to 0.11.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
