PT-2026-30275 · Vllm · Vllm

Arthur-Stat + 7 · Published 2026-04-03 · Updated 2026-04-06 · CVE-2026-34753

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions vLLM versions 0.16.0 through 0.18.99

Description vLLM, an inference and serving engine for large language models, contains a server-side request forgery (SSRF) flaw in the download bytes from url function. This allows an attacker who can control the batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server, without any URL validation or domain restrictions. The vulnerability resides in the run batch.py file, specifically within the download bytes from url function, which directly calls session.get(url) on a URL provided in the batch input JSON. The file url parameter within BatchTranscriptionRequest and BatchTranslationRequest is vulnerable, as it lacks domain, IP, or port restrictions. This can be exploited to target internal services reachable from the vLLM host.

Recommendations Update to vLLM version 0.19.0 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-34753

GHSA-PF3H-QJGV-VCPR

Affected Products

Vllm

References · 7

• https://github.com/vllm-project/vllm/security/advisories/GHSA-pf3h-qjgv-vcpr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34753 · Security Note
• https://osv.dev/vulnerability/GHSA-pf3h-qjgv-vcpr · Vendor Advisory
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/commit/57861ae48d3493fa48b4d7d830b7ec9f995783e7 · Note
• https://github.com/vllm-project/vllm/pull/38482 · Note
• https://twitter.com/CVEnew/status/2041223992451756096 · Twitter Post