CVE-2026-126395
Image-processing errors could disclose a vLLM server memory address
vLLM · Client-facing error handling
First documented disclosure · Review checkpoint
Summary
The error sanitizer missed address formats used by the image library. An error could reveal an address in the server process. The researcher did not report a read of memory contents.
Severity and exploitation evidence
Medium · 6.9/10 · CVSS 4.0. Severity source.
Exploitation not established: The reviewed sources describe the weakness and correction. They identify no confirmed malicious use.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
The error sanitizer missed address formats used by the image library.
Conditions required
A client can submit image inputs that cause a processor error to be returned.
Potential impact
An error could reveal an address in the server process. The researcher did not report a read of memory contents.
Affected versions and configurations
0.14.0rc1 through releases before 0.31.0.
Fix and mitigation status
0.31.0 for this issue.
Practical next steps
Use a supported vLLM release containing the 0.31.0 fix.
Operating lesson
Return opaque error identifiers to clients and keep raw processor exceptions in access-controlled logs.
Evidence and limits
The issuing CNA published the CVE record on 2026-11-13.
Sources
- vLLM project security advisory
Primary source ·
- Public vLLM project change
Primary source ·
- Issuing CNA record and severity assessment
Primary source ·