CVE-2025-6242
Full vulnerability record from the local CVENow database.
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.
Severity
HIGH
CVSS score
7.1
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-10-07 20:15:36.187000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-6242",
"sourceIdentifier": "[email protected]",
"published": "2025-10-07T20:15:36.187",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources."
},
{
"lang": "es",
"value": "Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) existe en la clase MediaConnector dentro del conjunto de características multimodales del proyecto vLLM. Los métodos load_from_url y load_from_url_async obtienen y procesan medios de URLs proporcionadas por el usuario sin restricciones adecuadas en los hosts de destino. Esto permite a un atacante coaccionar al servidor vLLM para que realice peticiones arbitrarias a recursos de red internos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis-preview/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-tpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-amd-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-aws-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-azure-amd-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-azure-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-gcp-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-intel-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/disk-image-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/docling-serve-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/gemma-2-9b-it",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/gemma-2-9b-it-fp8",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-3.1-8b-lab-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-3.1-8b-lab-v2.1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-3.1-8b-starter-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-3.1-8b-starter-v2.1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-7b-redhat-lab",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-7b-starter",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-8b-code-base",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-8b-code-instruct",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-8b-lab-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-8b-lab-v2-preview",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/granite-8b-starter-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/instructlab-amd-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/instructlab-intel-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/instructlab-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/knowledge-adapter-v3",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/mixtral-8x7b-instruct-v0-1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-docling-layout",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-docling-tableformer",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-gemma-2-9b-it",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-gemma-2-9b-it-fp8",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-3-1-8b-lab-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-3-1-8b-lab-v2",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-3-1-8b-lab-v2-1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-3-1-8b-starter-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-3-1-8b-starter-v2",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-3-1-8b-starter-v2-1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-7b-redhat-lab",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-7b-starter",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-8b-code-base",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-8b-code-instruct",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-8b-lab-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-8b-lab-v2-preview",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-granite-8b-starter-v1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-knowledge-adapter-v3",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-mixtral-8x7b-instruct-v0-1",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-prometheus-8x7b-v2-0",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-skills-adapter-v3",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/modelcar-snowflake-arctic-embed-l-v2.0",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/pathservice-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/prometheus-8x7b-v2-0",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/skills-adapter-v3",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/ui-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-07T19:55:28.751523Z",
"id": "CVE-2025-6242",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2025-6242",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373716",
"source": "[email protected]"
}
]
}