CVE-2026-54236

Affected versions of the vLLM package are vulnerable to Information Disclosure due to inadequate sanitization of exception messages. The `api_router.py` and `connection.py` files contain exception handlers that directly echo `str(exc)` to clients without applying `sanitize_message`, allowing memory addresses to be included in error messages. An attacker can exploit this vulnerability by sending malformed image bytes that trigger exceptions, resulting in the leakage of heap addresses in the response body, significantly reducing ASLR entropy and potentially aiding in further attacks.