FIX CARD
PRODUCT vLLM
SEVERITY MEDIUM
vLLM CVE-2026-54236 — memory addresses leaked in error messages
Why it matters
Your vLLM version leaks Python object memory addresses inside API error messages (an incomplete fix for CVE-2026-22778). Alone this is an info leak; combined with another bug it helps an attacker defeat ASLR.
Fix it: 2 steps
- Upgrade vLLM to 0.23.0 or later.
- Keep the API behind authentication or off the public IP so unauthenticated clients cannot trigger the leaking error paths.
Verify it’s fixed
curl -m 5 http://127.0.0.1:8000/version # version must be >= 0.23.0
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-hgg8-fqqc-vfmw
- https://advisories.gitlab.com/pypi/vllm/CVE-2026-54236/
CVE mapping behind this card: human-verified, last checked 2026-07-29.
Not sure if your stack is exposed?
Run the free check: usually under a minute, safe read-only probes.
Scan your stack