← fix library

MEDIUM vLLM: vLLM CVE-2026-54236 — memory addresses leaked in error messages

Why it matters

Your vLLM version leaks Python object memory addresses inside API error messages (an incomplete fix for CVE-2026-22778). Alone this is an info leak; combined with another bug it helps an attacker defeat ASLR.

Fix it — 2 steps

1. Upgrade vLLM to 0.23.0 or later.
2. Keep the API behind authentication or off the public IP so unauthenticated clients cannot trigger the leaking error paths.

Verify it’s fixed

curl -m 5 http://127.0.0.1:8000/version  # version must be >= 0.23.0

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hgg8-fqqc-vfmw
• https://advisories.gitlab.com/pypi/vllm/CVE-2026-54236/