When vLLM receives malformed JSON requests, FastAPI raises a Pydantic RequestValidationError. The vLLM error handler converts this exception to a string including internal file paths and line numbers, which are returned in HTTP responses. The existing sanitization removes memory addresses but not file path and line number patterns, resulting in leakage of sensitive environment details such as OS username, home directory, Python version, internal package structure, and handler function names. This vulnerability affects all JSON POST endpoints and enables unauthenticated attackers to fingerprint the system and narrow attack surfaces. The issue was fixed by changing the error handler to construct error messages from structured error data rather than stringifying the exception, or alternatively by improving the sanitization regex.

An unauthenticated attacker can obtain sensitive internal information including OS username, home directory path, virtual environment path, Python version, internal source file paths with line numbers, and handler function names. This information disclosure can facilitate targeted attacks by enabling precise version fingerprinting and reducing the attack surface. The vulnerability does not allow direct code execution or data modification but leaks environment details that aid attackers.

A fix is available in vLLM version 0.26.0 that changes the validation exception handler to avoid returning traceback-style strings in error responses. Users should upgrade to vLLM 0.26.0 or later. Alternatively, deploying vLLM behind a reverse proxy that rewrites error responses to remove file paths can mitigate the issue but is fragile. No other mitigations are recommended as the root cause is addressed in the official fix.