X41J

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.3.0 through 0.21.0 **Description** An authentication bypass exists in the OpenAI API `AuthenticationMiddleware` due to improper trust in the reconstructed URL path from the ASGI scope. The `url path` is derived from a `URL` object reconstructed by starlette using the request `scope`, which includes the `Host` header. Because starlette and ASGI servers (such as uvicorn) do not properly filter the `Host` header for invalid characters, an attacker can inject special characters like `/` or `?` into the `Host` header to manipulate the `.path` attribute. Since FastAPI and starlette routing rely on the HTTP path rather than the parsed `url.path` attribute, an attacker can bypass authentication checks for routes starting with `/v1` and access the API without a valid `VLLM API KEY` or `--api-key`. Instances behind RFC-conforming web servers, such as nginx, are not affected. **Recommendations** Update to version 0.22.0.

**Name of the Vulnerable Software and Affected Versions** Starlette versions prior to 1.0.1 **Description** Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework, fails to validate the HTTP `Host` request header before using it to reconstruct `request.url`. While the routing algorithm uses the raw HTTP path, `request.url` is rebuilt using the `Host` header. An attacker can send a specially crafted `Host` header containing characters such as `/`, `?`, or `#` to shift path, query, or fragment boundaries during re-parsing. This causes `request.url.path` to differ from the actual requested path. Consequently, middleware or endpoints that enforce security restrictions based on `request.url` (instead of the raw `scope` path) can be bypassed, potentially allowing unauthorized access to protected endpoints. **Recommendations** Upgrade to version 1.0.1 or later. As a temporary workaround, use `request.scope["path"]` instead of `request.url.path` for security-sensitive decisions. Restrict or normalize the `Host` header at the reverse proxy or load balancer level before it reaches the application.