CVE-2026-73555: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in

vLLM, a software that runs and serves large language models, has a security flaw in versions before 0.26.0 where error messages from malformed requests reveal sensitive information like the operating system username, file paths, and internal code details to anyone who sends specially crafted requests. The problem occurs because the error handling code doesn't properly hide sensitive details when something goes wrong.