{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2025-6242", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-06-18T15:26:11.100Z", "datePublished": "2025-10-07T19:45:18.082Z", "dateUpdated": "2025-10-17T11:03:08.400Z" }, "containers": { "cna": { "title": "Vllm: server side request forgery (ssrf) in mediaconnector", "metrics": [ { "other": { "content": { "value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H", "version": "3.1" }, "format": "CVSS" } ], "descriptions": [ { "lang": "en", "value": "A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources." } ], "affected": [ { "vendor": "Red Hat", "product": "Red Hat AI Inference Server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhaiis-preview/vllm-cuda-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ] }, { "vendor": "Red Hat", "product": "Red Hat AI Inference Server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhaiis/vllm-cuda-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ] }, { "vendor": "Red Hat", "product": "Red Hat AI Inference Server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhaiis/vllm-rocm-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ] }, { "vendor": "Red Hat", "product": "Red Hat AI Inference Server", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhaiis/vllm-tpu-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:ai_inference_server:3" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/bootc-amd-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/bootc-aws-nvidia-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/bootc-azure-amd-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/bootc-azure-nvidia-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/bootc-gcp-nvidia-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/bootc-intel-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/bootc-nvidia-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/disk-image-nvidia-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/docling-serve-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/gemma-2-9b-it", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/gemma-2-9b-it-fp8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-3.1-8b-lab-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-3.1-8b-lab-v2.1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-3.1-8b-starter-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-3.1-8b-starter-v2.1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-7b-redhat-lab", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-7b-starter", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-8b-code-base", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-8b-code-instruct", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-8b-lab-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-8b-lab-v2-preview", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/granite-8b-starter-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/instructlab-amd-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/instructlab-intel-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/instructlab-nvidia-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/knowledge-adapter-v3", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/mixtral-8x7b-instruct-v0-1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-docling-layout", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-docling-tableformer", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-gemma-2-9b-it", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-gemma-2-9b-it-fp8", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-3-1-8b-lab-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-3-1-8b-lab-v2", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-3-1-8b-lab-v2-1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-3-1-8b-starter-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-3-1-8b-starter-v2", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-3-1-8b-starter-v2-1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-7b-redhat-lab", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-7b-starter", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-8b-code-base", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-8b-code-instruct", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-8b-lab-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-8b-lab-v2-preview", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-granite-8b-starter-v1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-knowledge-adapter-v3", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-mixtral-8x7b-instruct-v0-1", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-prometheus-8x7b-v2-0", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-skills-adapter-v3", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/modelcar-snowflake-arctic-embed-l-v2.0", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/pathservice-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/prometheus-8x7b-v2-0", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/skills-adapter-v3", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhelai1/ui-rhel9", "defaultStatus": "affected", "cpes": [ "cpe:/a:redhat:enterprise_linux_ai:1" ] } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2025-6242", "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373716", "name": "RHBZ#2373716", "tags": [ "issue-tracking", "x_refsource_REDHAT" ] } ], "datePublic": "2025-10-07T00:00:00.000Z", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE" } ] } ], "x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)", "workarounds": [ { "lang": "en", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible." } ], "timeline": [ { "lang": "en", "time": "2025-06-18T15:26:47.633Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2025-10-07T00:00:00.000Z", "value": "Made public." } ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-10-17T11:03:08.400Z" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-10-07T19:55:28.751523Z", "id": "CVE-2025-6242", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-07T19:57:03.472Z" } } ] } }