CVE-2026-54236: vLLM Memory Address Disclosure via Anthropic API Error Messages

Technical summary

CVE-2026-54236 is an information disclosure vulnerability in vLLM's exception handling across multiple API endpoints. The core issue is that CVE-2026-22778 introduced a sanitize_message helper to strip object repr addresses from error messages, but this sanitization is not consistently applied. Specifically, three code paths construct and return JSONResponse objects directly without invoking the sanitizing global FastAPI exception handler: (1) the Anthropic API router's POST /v1/messages and POST /v1/messages/count_tokens handlers in vllm/entrypoints/anthropic/api_router.py, (2) the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and (3) the realtime speech-to-text WebSocket handler in vllm/entrypoints/speech_to_text/realtime/connection.py. When PIL.Image.open raises an UnidentifiedImageError in response to malformed image bytes, the exception message contains the BytesIO object repr, which includes a heap memory address. This address is returned verbatim in the error.message field of the response body, bypassing the sanitization layer. WebSocket frames do not traverse the FastAPI exception handler chain, making the WebSocket endpoint particularly vulnerable.

Business impact

This vulnerability poses a moderate but meaningful risk to organizations running vLLM-based inference services. Memory address disclosure alone is not immediately exploitable, but it undermines a fundamental defense-in-depth control: Address Space Layout Randomization (ASLR). An attacker who can repeatedly leak heap addresses gains valuable reconnaissance for launching more complex attacks—either against the vLLM process itself or potentially against the host system. In production environments where vLLM is exposed to untrusted users or integrated into public-facing APIs, this information leak could be chained with other vulnerabilities to achieve remote code execution. The ease of exploitation (no authentication required, simple malformed image upload) increases the risk. Organizations should prioritize patching, especially if their vLLM instance is accessible over networks or the internet.

Affected systems

vLLM versions prior to 0.23.1rc0 are affected. The vulnerability is present in all installations that expose the Anthropic API-compatible endpoints (/v1/messages, /v1/messages/count_tokens) or the realtime speech-to-text WebSocket endpoint. Open-source users running self-hosted vLLM instances are the primary audience. The scope is not limited to a specific model or deployment configuration; any vLLM instance with these endpoints enabled can be exploited. Users running version 0.23.1rc0 or later are not affected.

Exploitability

Exploitation is straightforward and requires no authentication. An attacker sends a POST request to the Anthropic Messages API endpoint with an image content part containing malformed image bytes (e.g., random binary data that PIL cannot decode). vLLM attempts to open the image, encounters an UnidentifiedImageError, and returns the error message containing the leaked heap address. The CVSS score of 5.3 reflects the low complexity (Low) and lack of privilege requirements (None), but acknowledges that the impact is information disclosure only (Confidentiality: Low) with no direct impact on integrity or availability. The network-accessible attack surface and ease of triggering the error make this a practical concern, though not an immediate critical risk.

Remediation

Upgrade to vLLM version 0.23.1rc0 or later. This release includes a complete fix that ensures all exception paths—including the Anthropic API router, SSE streaming converter, and WebSocket handlers—apply the sanitize_message helper before returning error responses to clients. Users unable to upgrade immediately should consider network-based mitigations: restrict API access to trusted clients, implement rate limiting on error-prone endpoints, and monitor for repeated malformed image submission attempts that could indicate reconnaissance activity.

Patch guidance

Verify compatibility with your deployment before upgrading. Review vLLM's release notes for version 0.23.1rc0 to confirm any breaking changes or dependency updates. If you are running a release build rather than a release candidate, wait for the stable 0.23.1 release. For containerized deployments, rebuild your images with the patched vLLM version. Test the patched version in a staging environment to ensure model serving performance and correctness remain unaffected. If you cannot upgrade immediately, consider disabling the Anthropic API endpoints or the speech-to-text WebSocket if they are not actively used in your service.

Detection guidance

Monitor access logs for repeated POST requests to /v1/messages or /v1/messages/count_tokens endpoints with image content parts, especially those receiving error responses. Look for patterns of malformed or random binary data in image submissions. Log analysis should flag any error.message fields in API responses that contain hexadecimal patterns consistent with memory addresses (e.g., '0x7f...'). Additionally, monitor WebSocket connections to the speech-to-text endpoint for abrupt disconnections or error frames that might indicate an attacker probing for errors. Alert on any unauthenticated API requests from unusual sources if your vLLM instance is meant to be internal-only.

Why prioritize this

While the CVSS score is 5.3 (Medium), this vulnerability should be prioritized for patching because: (1) exploitation is trivial and requires no authentication, (2) the attacker surface is broad (multiple API endpoints), (3) information disclosure about memory layout can enable follow-on attacks, and (4) a fix is readily available. Organizations with public-facing or network-exposed vLLM instances should patch within 1–2 weeks. Internal deployments with restricted network access can afford a longer timeline but should still plan an upgrade cycle.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects: Attack Vector: Network (AV:N)—the vulnerability is exploitable remotely; Attack Complexity: Low (AC:L)—no special conditions are needed; Privileges Required: None (PR:N)—unauthenticated users can trigger it; User Interaction: None (UI:N)—no victim action is required; Scope: Unchanged (S:U)—the impact is limited to the vulnerable component; Confidentiality: Low (C:L)—memory addresses are disclosed but do not directly expose user data or model weights; Integrity: None (I:N)—data is not modified; Availability: None (A:N)—service continuity is unaffected. The 'Low' confidentiality impact reflects that address leaks are a stepping stone rather than a complete information compromise. However, in contexts where ASLR defeats are a known precursor to RCE, practitioners may rate business risk higher than the numeric score suggests.

Frequently asked questions