Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54236— vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

Quick assessment

Affected
vllm-project vllm
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

vLLM是vLLM团队开源的一个适用于 LLM 的高吞吐量和内存高效推理和服务引擎。 vLLM 0.23.1rc0之前版本存在日志信息泄露漏洞，该漏洞源于sanitize_message清理消息的辅助函数不完整，导致多个响应路径直接向客户端输出异常消息，且Anthropic API路由器、Server-Sent Events流转换器和实时语音转文本WebSocket处理路径绕过了全局FastAPI异常处理器，可能造成未经验证的攻击者通过发送损坏的图像字节泄露堆内存地址。

CVSS 5.3 · Medium EPSS 0.93% · P59

Public Exploits 1

Nuclei · 1 CVE-2026-54236.yaml [template]

Affected Version Matrix 1

VendorProduct Version RangeStatus
vllm-project vllm < 0.23.1rc0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54236

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
Source: CVE Program / CVE List V5
Vulnerability Description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
vLLM 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
vLLM是vLLM团队开源的一个适用于 LLM 的高吞吐量和内存高效推理和服务引擎。 vLLM 0.23.1rc0之前版本存在日志信息泄露漏洞，该漏洞源于sanitize_message清理消息的辅助函数不完整，导致多个响应路径直接向客户端输出异常消息，且Anthropic API路由器、Server-Sent Events流转换器和实时语音转文本WebSocket处理路径绕过了全局FastAPI异常处理器，可能造成未经验证的攻击者通过发送损坏的图像字节泄露堆内存地址。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
vllm-project vllm < 0.23.1rc0 -

II. Public POCs for CVE-2026-54236

# POC Description Source Link Shenlong Link
1 vLLM <= 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitize_message to the OpenAI router but the Anthropic-compatible router (/v1/messages) echoes str(exc) directly. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-54236.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54236

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54236 (2)

Vendor Advisories for CVE-2026-54236 (1)

Same Patch Batch · vllm-project · 2026-06-22 · 8 CVEs total

CVE-2026-48746 9.1 CRITICAL vLLM: OpenAI auth bypass
CVE-2026-54232 8.8 HIGH vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile
CVE-2026-41523 7.5 HIGH vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arb
CVE-2026-47155 6.5 MEDIUM vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights,
CVE-2026-54233 6.5 MEDIUM vLLM: OOM Denial of Service via Audio Decompression Bomb
CVE-2026-53923 vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overfl
CVE-2026-54235 vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kern

IV. Related Vulnerabilities

Same product: vllm
Same vendor: vllm-project
Same weakness: CWE-532

V. Comments for CVE-2026-54236

No comments yet

Leave a comment