vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak
CVE-2026-54236
Verified
Description
vLLM <= 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitize_message to the OpenAI router but the Anthropic-compatible router (/v1/messages) echoes str(exc) directly.
Severity
Medium
CVSS Score
5.3
Exploit Probability
1%
Affected Product
vllm
Published Date
June 21, 2026
Template Author
kenlacroix
CVE-2026-54236.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-54236
CWE ID:
cwe-532
Remediation Steps
Update to vllm version to latest.