CVE-2026-54236: Vllm Information Disclosure Vulnerability

CVE-2026-54236 Overview

CVE-2026-54236 is an information disclosure vulnerability in vLLM, an inference and serving engine for large language models (LLMs). The flaw stems from an incomplete fix for CVE-2026-22778. While the prior patch introduced a sanitize_message helper to strip object-repr memory addresses from error messages, several response paths echo str(exc) directly to clients without invoking it. An unauthenticated attacker can trigger Python exceptions that leak heap memory addresses in the response body, weakening Address Space Layout Randomization (ASLR) protections. The issue is fixed in version 0.23.1rc0.

Critical Impact
Unauthenticated remote attackers can leak heap memory addresses from vLLM server processes by sending malformed image bytes through the Anthropic Messages API, exposing internals that aid further exploitation.

Affected Products

vLLM versions prior to 0.23.1rc0
Deployments exposing the Anthropic API router (/v1/messages, /v1/messages/count_tokens)
Deployments exposing the realtime speech-to-text WebSocket endpoint

Discovery Timeline

2026-06-22 - CVE-2026-54236 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54236

Vulnerability Analysis

The vulnerability is classified as Information Exposure Through an Error Message [CWE-532]. vLLM previously added a sanitize_message helper to strip Python object-repr memory addresses from exception strings before returning them to clients. The fix relied on a global FastAPI exception handler to invoke the sanitizer. However, multiple route coroutines catch exceptions internally and construct JSONResponse objects directly, bypassing the global handler chain. WebSocket frames never traverse the FastAPI exception handler at all, leaving them unprotected by design.

Root Cause

The unsanitized response paths reside in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket at vllm/entrypoints/speech_to_text/realtime/connection.py. Each path forwards str(exc) into the error.message field returned to the client without calling sanitize_message.

Attack Vector

An unauthenticated attacker sends malformed image bytes through Anthropic Messages API image content parts. The malformed payload causes PIL.Image.open to raise an UnidentifiedImageError whose message embeds the BytesIO object repr. The response body returns the heap memory address verbatim, providing the attacker with information useful for bypassing ASLR and chaining additional exploits against the host process.

python

# Security patch in vllm/entrypoints/anthropic/api_router.py
 from vllm.entrypoints.openai.engine.protocol import ErrorResponse
 from vllm.entrypoints.serve.utils.api_utils import (
     load_aware_call,
+    sanitize_message,
     validate_json_request,
     with_cancellation,
 )

Source: GitHub Commit 9492362

Detection Methods for CVE-2026-54236

Indicators of Compromise

HTTP 4xx/5xx responses from /v1/messages or /v1/messages/count_tokens containing hex-formatted memory addresses (e.g., 0x7f...) inside the error.message field.
WebSocket close frames or error frames from the speech-to-text realtime endpoint containing Python object representations such as <_io.BytesIO object at 0x...>.
Repeated POST requests with malformed base64 image payloads targeting Anthropic-compatible endpoints.

Detection Strategies

Inspect outbound vLLM API responses for memory address patterns matching 0x[0-9a-f]{8,16} within JSON error bodies.
Correlate exception logs from vLLM containing UnidentifiedImageError with client IPs that repeatedly submit image content parts.
Monitor for anomalous request volume to Anthropic-compatible routes on vLLM servers, particularly from unauthenticated sources.

Monitoring Recommendations

Forward vLLM application logs and HTTP access logs to a centralized analytics platform with regex-based alerts on memory-address patterns in response bodies.
Enable request and response capture on API gateways fronting vLLM to retain forensic evidence of probing attempts.
Track the version of deployed vLLM instances and alert when any node runs a release prior to 0.23.1rc0.

How to Mitigate CVE-2026-54236

Immediate Actions Required

Upgrade vLLM to version 0.23.1rc0 or later on all serving nodes.
Restrict network exposure of the Anthropic API router and speech-to-text WebSocket endpoints to authenticated clients only.
Audit logs for prior responses containing memory addresses to determine whether reconnaissance occurred.

Patch Information

The fix imports sanitize_message into both vllm/entrypoints/anthropic/api_router.py and vllm/entrypoints/anthropic/serving.py and applies it to error paths that previously echoed str(exc) directly. See the GitHub Security Advisory GHSA-hgg8-fqqc-vfmw and Pull Request #45119 for the complete fix.

Workarounds

Place vLLM behind a reverse proxy that rewrites or strips error response bodies containing hex memory address patterns.
Disable the Anthropic-compatible routes and the realtime speech-to-text WebSocket if they are not required for production workloads.
Enforce authentication and rate limiting on all vLLM endpoints to reduce the surface available to unauthenticated probing.

bash

# Upgrade vLLM to the patched release
pip install --upgrade 'vllm>=0.23.1rc0'

# Verify installed version
python -c "import vllm; print(vllm.__version__)"