CVE-2026-54236: CWE-532: Insertion of Sensitive Information into Log File in vllm-project vllm
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.
AI Analysis
Technical Summary
CVE-2026-54236 affects the vLLM inference and serving engine for large language models. The vulnerability arises because several response paths in the application echo exception messages directly to clients without sanitizing them, bypassing the sanitize_message helper introduced to strip memory addresses from error messages. Specifically, the Anthropic API router endpoints, the Server-Sent Events streaming converter, and the realtime speech-to-text WebSocket handlers do not use the global FastAPI exception handler that performs sanitization. An attacker can send malformed image bytes that cause PIL.Image.open to raise an UnidentifiedImageError containing a BytesIO object representation, which includes heap memory addresses. These addresses are leaked verbatim in the error.message field of the JSON response. The issue is resolved in vLLM version 0.23.1rc0.
Potential Impact
An unauthenticated attacker can cause the application to leak heap memory addresses in error messages returned by certain API endpoints and WebSocket handlers. This leakage of sensitive memory information may aid attackers in further attacks such as memory corruption or exploitation but does not directly impact integrity or availability. The CVSS score is 5.3 (medium severity) reflecting limited confidentiality impact with no integrity or availability impact.
Mitigation Recommendations
A fix for this vulnerability is available in vLLM version 0.23.1rc0. Users should upgrade to this version or later to ensure that all exception messages are properly sanitized and memory addresses are not leaked. Until upgraded, avoid exposing the vulnerable API endpoints or WebSocket handlers to untrusted users. Patch status is not explicitly stated beyond the fix in 0.23.1rc0; check the vendor advisory for the latest remediation guidance.
CVE-2026-54236: CWE-532: Insertion of Sensitive Information into Log File in vllm-project vllm
Description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54236 affects the vLLM inference and serving engine for large language models. The vulnerability arises because several response paths in the application echo exception messages directly to clients without sanitizing them, bypassing the sanitize_message helper introduced to strip memory addresses from error messages. Specifically, the Anthropic API router endpoints, the Server-Sent Events streaming converter, and the realtime speech-to-text WebSocket handlers do not use the global FastAPI exception handler that performs sanitization. An attacker can send malformed image bytes that cause PIL.Image.open to raise an UnidentifiedImageError containing a BytesIO object representation, which includes heap memory addresses. These addresses are leaked verbatim in the error.message field of the JSON response. The issue is resolved in vLLM version 0.23.1rc0.
Potential Impact
An unauthenticated attacker can cause the application to leak heap memory addresses in error messages returned by certain API endpoints and WebSocket handlers. This leakage of sensitive memory information may aid attackers in further attacks such as memory corruption or exploitation but does not directly impact integrity or availability. The CVSS score is 5.3 (medium severity) reflecting limited confidentiality impact with no integrity or availability impact.
Mitigation Recommendations
A fix for this vulnerability is available in vLLM version 0.23.1rc0. Users should upgrade to this version or later to ensure that all exception messages are properly sanitized and memory addresses are not leaked. Until upgraded, avoid exposing the vulnerable API endpoints or WebSocket handlers to untrusted users. Patch status is not explicitly stated beyond the fix in 0.23.1rc0; check the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-12T16:25:43.084Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a39b9b1eed863c81e85ffb0
Added to database: 06/22/2026, 22:39:45 UTC
Last enriched: 06/22/2026, 22:54:14 UTC
Last updated: 08/04/2026, 13:32:35 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.