CVE-2026-54236: vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
(updated )
The fix for CVE-2026-22778 / GHSA-4r2x-xpjr-7cvv (PRs #31987 and #32319) introduced sanitize_message and applied it at four FastAPI exception-handling sites in the OpenAI router. The sanitizer strips object-repr memory addresses (<_io.BytesIO object at 0x7a95e299e750> → <_io.BytesIO object>) before error messages reach the client, defeating the ASLR-bypass primitive that CVE-2026-22778 chained with a libopenjp2 heap overflow for RCE.
The fix is incomplete: response paths added to vLLM at or after the same time as the fix continue to echo str(exc) directly to clients without sanitize_message. The original Stage 1 primitive — sending malformed image bytes so PIL raises UnidentifiedImageError whose message contains the BytesIO object repr — reaches all of them unmodified and leaks the heap address verbatim in the response body.
All five lines below are present in main HEAD (771e1e48b, 2026-05-26).
References
- github.com/advisories/GHSA-hgg8-fqqc-vfmw
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3408.yaml
- github.com/vllm-project/vllm
- github.com/vllm-project/vllm/commit/94923629729381d7f7c9efde72071a2441f7fd82
- github.com/vllm-project/vllm/pull/45119
- github.com/vllm-project/vllm/security/advisories/GHSA-hgg8-fqqc-vfmw
- nvd.nist.gov/vuln/detail/CVE-2026-54236
- pypi.org/project/vllm
Code Behaviors & Features
Detect and mitigate CVE-2026-54236 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →