{"data":{"id":"67cc90f1-7681-4634-8908-7bb64ceb77da","title":"CVE-2026-126395: vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose…","summary":"vLLM versions from 0.14.0rc1 before 0.31.0 contain an information disclosure flaw in sanitize_message(). Its lowercase-only regex fails to scrub uppercase PIL image addresses from error messages. An unauthenticated attacker can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-126395","publishedAt":"2026-11-13T10:17:43.577Z","cveId":"CVE-2026-126395","cweIds":["CWE-532"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM information disclosure via uppercase PIL image addresses in error messages","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00389,"epssCheckedAt":"2026-11-13T18:11:31.371Z","kevDateAdded":null,"advisoryAliases":["GHSA-8hqr-48h6-r93j"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-13T18:11:35.935Z","patchAvailable":null,"disclosureDate":"2026-11-13T10:17:43.577Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-215"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}