The vLLM inference and serving engine for large language models has an SSRF vulnerability (CWE-918) in versions >= 0.16.0 and < 0.19.0. The vulnerability exists in the download_bytes_from_url function, which processes batch input JSON without validating or restricting URLs. This allows an attacker with the ability to control batch input to force the server to issue arbitrary HTTP/HTTPS requests, potentially accessing internal network resources. The vulnerability is addressed in vLLM version 0.19.0.

An attacker able to control batch input JSON can exploit this SSRF vulnerability to make the vLLM server send arbitrary HTTP/HTTPS requests. This can lead to unauthorized access to internal services reachable from the vLLM host, such as cloud metadata endpoints or internal APIs. The CVSS score of 5.4 (medium severity) reflects limited confidentiality impact, no integrity impact, and low availability impact. There are no known exploits in the wild at this time.

Upgrade vLLM to version 0.19.0 or later, where this SSRF vulnerability has been fixed. Since the vulnerability is resolved in the updated version, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor advisory indicating the fix in vLLM 0.19.0.