A vulnerability in the MediaConnector class of the vLLM inference engine allows an attacker to supply a media URL that bypasses the intended host‑restriction logic. The bug arises from different parsing rules for backslashes in two Python libraries used by the load_from_url and load_from_url_async methods, which enables attackers to coerce the server into making requests to internal network hosts. The resulting SSRF can expose sensitive internal services, trigger denial of service or cause unintended interactions with other components in containerised environments.

vllm-project vLLM, the open‑source LLM inference and serving engine. The flaw affects all deployments using the multimodal feature set prior to version 0.14.1. Version 0.14.1 introduces a patch that resolves the host‑restriction bypass.

The vulnerability is scored 7.1 on the CVSS scale, indicating moderate to high risk, while the EPSS score is below 1%, suggesting that the probability of exploitation at a given time remains low. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be remote, originating from user‑supplied media URLs that the server processes. Once exploited, an attacker can direct the vLLM pod to reach arbitrary internal endpoints, potentially accessing confidential data or disrupting service availability.