Executive brief
vLLM is an open-source engine used to run and serve Large Language Models (LLMs). A security flaw in how the system handles errors allows unauthenticated users to trigger specific error messages that reveal internal memory addresses of the server. While this does not directly allow an attacker to steal data, it provides critical information that can be used to bypass security protections (like ASLR) in more complex, multi-stage cyberattacks.
Technical details
An incomplete fix for a previous vulnerability (CVE-2026-22778) leaves several API response paths unsanitized in vLLM. Specifically, the Anthropic API router, Server-Sent Events (SSE) streaming converter, and speech-to-text WebSockets catch exceptions internally and return 'str(exc)' directly to the client. This bypasses the global FastAPI exception handler's 'sanitize_message' helper. An unauthenticated attacker can provide malformed image data to trigger a 'PIL.Image.open' error, which includes the memory address of a 'BytesIO' object in the exception string. This provides a primitive for bypassing Address Space Layout Randomization (ASLR). The issue is resolved in version 0.23.1rc0.
Affected products
- vllm-project vLLM < 0.23.1rc0
Timeline
- 2026-01-09: other: Initial partial fix introduced in PR #31987
- 2026-06-11: advisory: GitHub Security Advisory GHSA-hgg8-fqqc-vfmw published
- 2026-06-22: disclosed: CVE-2026-54236 published to NVD