Server-Side Request Forgery (SSRF)

🗓️ 05 Feb 2026 08:36:29Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 9 Views

vllm is vulnerable to server side forgery due to MediaConnector parsing and validation flaws.

Reporter	Title	Published	Views	Family All 30
ATTACKERKB	CVE-2026-24779	27 Jan 202622:01	–	attackerkb
ATTACKERKB	CVE-2026-25960	9 Mar 202621:01	–	attackerkb
Chainguard	CVE-2026-24779 vulnerabilities	27 Mar 202601:17	–	cgr
Circl	CVE-2026-24779	18 Mar 202620:40	–	circl
CNNVD	vLLM code issues and vulnerabilities	27 Jan 202600:00	–	cnnvd
CVE	CVE-2026-24779	27 Jan 202622:01	–	cve
Cvelist	CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`	27 Jan 202622:01	–	cvelist
EUVD	EUVD-2026-4711	28 Jan 202616:14	–	euvd
Github Security Blog	vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector	28 Jan 202616:14	–	github
NVD	CVE-2026-24779	27 Jan 202622:15	–	nvd

Vulners

Node

vllm vllmRange0.0.1–0.14.0python

vllm vllmMatch0.0.1python

vllm vllmMatch0.1.0python

vllm vllmMatch0.1.1python

vllm vllmMatch0.1.2python

vllm vllmMatch0.1.3python

vllm vllmMatch0.1.4python

vllm vllmMatch0.1.5python

vllm vllmMatch0.1.6python

vllm vllmMatch0.1.7python

vllm vllmMatch0.10.0python

vllm vllmMatch0.10.1python

vllm vllmMatch0.10.1.1python

vllm vllmMatch0.10.2python

vllm vllmMatch0.11.0python

vllm vllmMatch0.11.1python

vllm vllmMatch0.11.2python

vllm vllmMatch0.12.0python

vllm vllmMatch0.13.0python

vllm vllmMatch0.2.0python

vllm vllmMatch0.2.1python

vllm vllmMatch0.2.1.post1python

vllm vllmMatch0.2.2python

vllm vllmMatch0.2.3python

vllm vllmMatch0.2.4python

vllm vllmMatch0.2.5python

vllm vllmMatch0.2.6python

vllm vllmMatch0.2.7python

vllm vllmMatch0.3.0python

vllm vllmMatch0.3.1python

vllm vllmMatch0.3.2python

vllm vllmMatch0.3.3python

vllm vllmMatch0.4.0python

vllm vllmMatch0.4.0.post1python

vllm vllmMatch0.4.1python

vllm vllmMatch0.4.2python

vllm vllmMatch0.4.3python

vllm vllmMatch0.5.0python

vllm vllmMatch0.5.0.post1python

vllm vllmMatch0.5.1python

vllm vllmMatch0.5.2python

vllm vllmMatch0.5.3python

vllm vllmMatch0.5.3.post1python

vllm vllmMatch0.5.4python

vllm vllmMatch0.5.5python

vllm vllmMatch0.6.0python

vllm vllmMatch0.6.1python

vllm vllmMatch0.6.1.post1python

vllm vllmMatch0.6.1.post2python

vllm vllmMatch0.6.2python

vllm vllmMatch0.6.3python

vllm vllmMatch0.6.3.post1python

vllm vllmMatch0.6.4python

vllm vllmMatch0.6.4.post1python

vllm vllmMatch0.6.5python

vllm vllmMatch0.6.6python

vllm vllmMatch0.6.6.post1python

vllm vllmMatch0.7.0python

vllm vllmMatch0.7.1python

vllm vllmMatch0.7.2python

vllm vllmMatch0.7.3python

vllm vllmMatch0.8.0python

vllm vllmMatch0.8.1python

vllm vllmMatch0.8.2python

vllm vllmMatch0.8.3python

vllm vllmMatch0.8.4python

vllm vllmMatch0.8.5python

vllm vllmMatch0.8.5.post1python

vllm vllmMatch0.9.0python

vllm vllmMatch0.9.0.1python

vllm vllmMatch0.9.1python

vllm vllmMatch0.9.2python

Source	Link
github	www.github.com/vllm-project/vllm/pull/32746
github	www.github.com/vllm-project/vllm/commit/f46d576c54fb8aeec5fc70560e850bed38ef17d7
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/CVE-2026-24779
access	www.access.redhat.com/errata/RHSA-2026:3782
access	www.access.redhat.com/errata/RHSA-2026:3462
access	www.access.redhat.com/errata/RHSA-2026:3461
access	www.access.redhat.com/errata/RHSA-2026:30089
access	www.access.redhat.com/errata/RHSA-2026:42644
access	www.access.redhat.com/errata/RHSA-2026:30087

01 Aug 2026 18:27Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.1

EPSS0.00529

SSVC