The vLLM project, an inference and serving engine for large language models, contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in its MediaConnector class before version 0.14.1. The vulnerability stems from the use of two different Python parsing libraries in the load_from_url and load_from_url_async methods, which interpret backslashes differently. This discrepancy allows attackers to bypass hostname restrictions and force the vLLM server to make arbitrary requests to internal network resources. In containerized deployments such as llm-d, exploitation could enable scanning of internal networks, interaction with other pods, and denial of service or unauthorized access to sensitive data. The vulnerability is patched in version 0.14.1.

Successful exploitation allows an attacker with limited privileges to bypass hostname restrictions and coerce the vLLM server into making arbitrary HTTP requests to internal network resources. This can lead to unauthorized internal network scanning, interaction with other containerized services, denial of service by sending malicious requests to management endpoints, and potential exposure of sensitive data. The vulnerability has a CVSS 3.1 score of 7.1 (high severity), indicating a significant impact on confidentiality and availability.

A patch addressing this SSRF vulnerability is available in vLLM version 0.14.1. Users should upgrade to version 0.14.1 or later to remediate the issue. Since this is not a cloud service, remediation requires applying the official fix. Refer to the vendor advisories, including Red Hat's security advisories, for detailed update instructions and confirmation of the fix.