vLLM has SSRF Protection Bypass

Summary

The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client.

Affected Component

• File: vllm/connections.py
• Function: load_from_url_async

Vulnerability Details

Root Cause

The SSRF fix uses urllib3.util.parse_url() to validate and extract the hostname from user-provided URLs. However, load_from_url_async uses aiohttp for making the actual HTTP requests, and aiohttp internally uses the yarl library for URL parsing.

These two URL parsers handle backslash characters (\) differently:

Parser	Input URL	Parsed Host	Parsed Path	Behavior
urllib3.parse_url()	https://httpbin.org\@evil.com/	httpbin.org	/%[email protected]/	URL-encodes \ as %5C, treats \@evil.com/ as part of the path
yarl (via aiohttp)	https://httpbin.org\@evil.com/	evil.com	/	Treats \ as part of userinfo (user: httpbin.org\), the @ acts as the userinfo/host separator

Attack Scenario

# Attacker provides this URL
malicious_url = "https://httpbin.org\\@evil.com/"

# 1. Validation layer (urllib3.parse_url)
parsed = urllib3.util.parse_url(malicious_url)
# parsed.host == "httpbin.org"  ✅ Passes validation

# 2. Actual request (aiohttp with yarl)
async with aiohttp.ClientSession() as session:
    async with session.get(malicious_url) as response:
        # Request actually goes to evil.com!  ❌ Bypass!

Why This Happens

1. : Interprets as the userinfo component, and as the userinfo/host separator, so the URL is parsed as , ,