CVE-2026-54236 vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

What is CVE-2026-54236?

CVE-2026-54236 is a medium-severity vulnerability in Vllm Vllm, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.

Weakness: CWE-532

Which versions are affected by CVE-2026-54236?

3 open source packages ship an affected version, including vllm. It affects 1 product.

Products include Vllm Vllm.

How do I fix CVE-2026-54236?

Upgrade vllm to 0.24.0 or later.

Is CVE-2026-54236 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54236 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Vllm Vllm

• CVE-2025-32444 vLLM Vulnerable to Remote Code Execution via Mooncake Integration Critical 10.0
• CVE-2026-22778 vLLM leaks a heap address when PIL throws an error Critical 9.8
• CVE-2025-47277 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service Critical 9.8
• CVE-2024-11041 Remote Code Execution in vllm-project/vllm Critical 9.8
• CVE-2026-48746 vLLM: OpenAI auth bypass Critical 9.1

All Vllm Vllm vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hgg8-fqqc-vfmw, MINI-3j4q-6399-w2vj, MINI-9gcq-m48c-c3rr, MINI-jvqw-774c-mmp8, PYSEC-2026-3408.