CVE-2025-6242: falha de alta gravidade em Red Hat AI Inference Server
Vllm: server side request forgery (ssrf) in mediaconnector
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Produtos afetados
Red Hat · Red Hat AI Inference ServerRed Hat · Red Hat Enterprise Linux AI (RHEL AI)CVEs relacionadas — Red Hat AI Inference Server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2024-8768HIGHVllm: a completions api request with an empty prompt will crash the vllm api server.EPSS 0.7%CVE-2026-56209HIGHLibaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijackEPSS 0.6%CVE-2026-56208HIGHLibaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap modeEPSS 0.6%CVE-2026-56210HIGHLibaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_idEPSS 0.6%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%