CVE-2025-6242: Red Hat Ai Inference Server

High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources.

Affected products

• Red Hat Red Hat Ai Inference Server
• Red Hat Red Hat Enterprise Linux Ai Rhel Ai

Published 2025-10-07. Last modified 2026-06-17.