CVE-2026-73555

Katalog CVE

CVSS 5.3 · Medium EPSS 0,41%

Kerentanan Generation of Error Message Containing Sensitive Information pada vllm. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

2 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hwrm-c4cx-rf4j mitigasi · advisory vendor
• https://github.com/vllm-project/vllm/commit/e87521626febe2763f997691d1599de4175f4324 patch
• https://github.com/vllm-project/vllm/pull/46415 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.26.0 release notes