vLLM, an inference engine for large language models, contains a server‑side request forgery flaw in the download_bytes_from_url function. An attacker who can supply or modify the JSON payload sent to the batch endpoint can cause the vLLM server to initiate arbitrary HTTP or HTTPS requests. Because the function lacks URL validation or domain whitelisting, the attacker can reach any internal or external web resource visible to the host.

The vulnerability affects versions of the vLLM project from 0.16.0 up to, but not including, 0.19.0. Systems running those releases with publicly exposed inference endpoints are susceptible. Updating to vLLM 0.19.0 or later removes the flaw.

With a CVSS score of 5.4 the issue is categorized as moderate severity. The exploit does not require authentication and can be triggered through normal API usage for batch inference. The lack of an EPSS score and absence from the CISA KEV list suggest limited current exploitation data, but the ability to reach internal services such as cloud metadata endpoints could enable data exfiltration or lateral movement if the host is connected to sensitive networks.