CVE-2025-6242: fallo de gravedad alta en Red Hat AI Inference Server
Vllm: server side request forgery (ssrf) in mediaconnector
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.3%
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Productos afectados
Red Hat · Red Hat AI Inference ServerRed Hat · Red Hat Enterprise Linux AI (RHEL AI)CVEs relacionadas — Red Hat AI Inference Server
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2024-8768HIGHVllm: a completions api request with an empty prompt will crash the vllm api server.EPSS 0.7%CVE-2026-56209HIGHLibaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijackEPSS 0.6%CVE-2026-56208HIGHLibaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap modeEPSS 0.6%CVE-2026-56210HIGHLibaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_idEPSS 0.6%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%