5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54236

CVE-2026-54236: vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54236

CVE-2026-54236:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	<= 0.23.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by an incomplete fix for a previous vulnerability (CVE-2026-22778). The original fix introduced a sanitize_message function to prevent leaking memory addresses in error messages but failed to apply it in all necessary locations. Specifically, several new API endpoints and streaming handlers added after the original fix did not use the sanitizer.

The vulnerability exists in multiple locations where exceptions are caught, and the exception message (str(e)) is returned in an API response or sent over a WebSocket without being sanitized. An attacker can trigger this vulnerability by sending a malformed request, such as an image with invalid format, which causes an exception in the server. The resulting error message, containing sensitive information like memory addresses from object representations (e.g., <_io.BytesIO object at 0x7a95e299e750>), is then leaked to the attacker. This information leak can be used to bypass security mechanisms like ASLR.

The vulnerable functions are:

vllm.entrypoints.anthropic.api_router.create_messages: Handles POST /v1/messages and returns unsanitized exception messages.
vllm.entrypoints.anthropic.api_router.count_tokens: Handles POST /v1/messages/count_tokens and returns unsanitized exception messages.
vllm.entrypoints.anthropic.serving.AnthropicServing._stream_response_handler: A generator for streaming responses that yields unsanitized exception messages.
vllm.entrypoints.speech_to_text.realtime.connection.Connection.handle_connection: Handles WebSocket connections and sends unsanitized exception messages.
vllm.entrypoints.speech_to_text.realtime.connection.Connection._run_generation: Part of the WebSocket logic that sends unsanitized exception messages.

The fix involves applying the sanitize_message function to the exception message in all these locations before sending it to the client.

Vulnerable functions

create_messages

vllm/entrypoints/anthropic/api_router.py

The function `create_messages` catches exceptions and returns the exception message directly to the user without sanitization. This can leak sensitive information, such as memory addresses, from the exception message.

count_tokens

vllm/entrypoints/anthropic/api_router.py

The function `count_tokens` catches exceptions and returns the exception message directly to the user without sanitization. This can leak sensitive information, such as memory addresses, from the exception message.

handle_connection

vllm/entrypoints/speech_to_text/realtime/connection.py

The function `handle_connection` catches exceptions and sends the exception message over a WebSocket connection without sanitization. This can leak sensitive information, such as memory addresses, from the exception message.

_run_generation

vllm/entrypoints/speech_to_text/realtime/connection.py

The function `_run_generation` catches exceptions and sends the exception message over a WebSocket connection without sanitization. This can leak sensitive information, such as memory addresses, from the exception message.

AnthropicServing._stream_response_handler

vllm/entrypoints/anthropic/serving.py

The function `_stream_response_handler` in the `AnthropicServing` class has a generator that catches exceptions and yields an error event containing the unsanitized exception message. This can leak sensitive information, such as memory addresses, from the exception message in a streaming response.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.