{"data":{"id":"0c0fb401-a84a-41b0-9ab6-72fad19b95b3","title":"CVE-2026-73555: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in…","summary":"vLLM versions prior to 0.26.0 leak internal details in validation error responses. The validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py fails to strip traceback-style file paths. An unauthenticated attacker sending malformed JSON to /v1/chat/completions, /v1/completions, /tokenize, or /detokenize can learn the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names.","solution":"Fixed in 0.26.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73555","publishedAt":"2026-08-13T15:20:17.773Z","cveId":"CVE-2026-73555","cweIds":["CWE-209"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["vllm@< 0.26.0 (fixed: 0.26.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM information disclosure via malformed JSON requests","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00413,"epssCheckedAt":"2026-11-14T06:04:28.877Z","kevDateAdded":null,"advisoryAliases":["GHSA-hwrm-c4cx-rf4j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:45:27.880Z","patchAvailable":true,"disclosureDate":"2026-08-13T15:20:17.773Z","fixReleasedAt":"2026-07-25T10:40:02.845Z","daysToFix":-19,"fixCheckedAt":"2026-10-29T21:31:58.699Z","capecIds":["CAPEC-54"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.26.0","matchedVersion":"0.26.0","fixReleasedAt":"2026-07-25T10:40:02.845Z","daysToFix":-19,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:31:58.525Z"}]}}