CVE-2026-54236

Unsanitized vLLM errors could reveal a process address through an alternate router

vLLM · Anthropic-compatible API error handling

First documented disclosure · Review checkpoint

Summary

Exception reporting in the alternate router bypassed address sanitization used elsewhere. Address disclosure can weaken memory randomization. The disclosure alone gives no access to memory contents.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources describe the weakness and correction. They identify no confirmed malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Exception reporting in the alternate router bypassed address sanitization used elsewhere.

Conditions required

A client can reach the affected router and receive processor error responses.

Potential impact

Address disclosure can weaken memory randomization. The disclosure alone gives no access to memory contents.

Affected versions and configurations

The project lists stable releases through 0.23.0. The CNA defines the boundary as before 0.23.1rc0.

Fix and mitigation status

0.24.0 for this issue.

Practical next steps

Use a supported vLLM release containing the 0.24.0 fix.

Operating lesson

Test error redaction across every compatibility router.

Evidence and limits

A later advisory documents a separate error-format issue that the project corrected in 0.31.0. The issuing CNA published the CVE record on 2026-06-22.

Sources