vLLM incorporates a method, load_from_url_async, that fetches user‑supplied URLs for model weight loading. The SSRF protection introduced in v0.15.1 relies on urllib3’s URL parser to validate hostnames, but load_from_url_async internally uses aiohttp, which parses URLs with yarl. The mismatch in hostname extraction allows an attacker to craft a URL that appears safe to the validator yet resolves to any target, including internal network services. This bypass can lead to unauthorized read or possible interaction with sensitive internal endpoints, violating confidentiality and potentially allowing further exploitation if those internal services are vulnerable.

The vulnerability affects the vLLM inference engine from the vllm‑project, specifically releases that include the load_from_url_async method. Current evidence indicates impact for v0.17.0, and versions earlier than v0.15.1 that lack the SSRF fix are inherently vulnerable as they do not contain protective logic.

The Common Vulnerability Scoring System assigns a 7.1 score, indicating a high risk level. The Exploit Prediction Scoring System shows a probability of less than 1 %, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers would exploit the flaw by sending crafted payloads to any exposed vLLM API endpoint that accepts load_from_url_async calls. If the application is reachable from untrusted networks, the risk escalates, whereas internal exposure mitigates the attack surface.