Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-6242

Good to know:

icon
icon

Date: October 7, 2025

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.

Severity Score

Related Resources (7)

https://bugzilla.redhat.com/show_bug.cgi?id=2373716
https://access.redhat.com/security/cve/CVE-2025-6242
https://nvd.nist.gov/vuln/detail/CVE-2025-6242
https://github.com/vllm-project/vllm/security/advisories/GHSA-3f6c-7fw2-ppm4
https://github.com/vllm-project/vllm/commit/9d9a2b77f19f68262d5e469c4e82c0f6365ad72d
https://github.com/vllm-project/vllm
https://www.mend.io/vulnerability-database/CVE-2025-6242

Severity Score

Weakness Type (CWE)

Server-Side Request Forgery (SSRF)

CWE-918

URL Redirection to Untrusted Site ('Open Redirect')

CWE-601

Top Fix

icon

Upgrade Version

Upgrade to version vllm - 0.11.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): LOW
Availability (A): HIGH

Do you need more information?

Contact Us