CVE-2026-54236: vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
(updated )
The fix for CVE-2026-22778 / GHSA-4r2x-xpjr-7cvv (PRs #31987 and #32319) introduced sanitize_message and applied it at four FastAPI exception-handling sites in the OpenAI router. The sanitizer strips object-repr memory addresses (<_io.BytesIO object at 0x7a95e299e750> → <_io.BytesIO object>) before error messages reach the client, defeating the ASLR-bypass primitive that CVE-2026-22778 chained with a libopenjp2 heap overflow for RCE.
The fix is incomplete: response paths added to vLLM at or after the same time as the fix continue to echo str(exc) directly to clients without sanitize_message. The original Stage 1 primitive — sending malformed image bytes so PIL raises UnidentifiedImageError whose message contains the BytesIO object repr — reaches all of them unmodified and leaks the heap address verbatim in the response body.
All five lines below are present in main HEAD (771e1e48b, 2026-05-26).
References
- github.com/advisories/GHSA-hgg8-fqqc-vfmw
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-3408.yaml
- github.com/vllm-project/vllm
- github.com/vllm-project/vllm/commit/94923629729381d7f7c9efde72071a2441f7fd82
- github.com/vllm-project/vllm/pull/45119
- github.com/vllm-project/vllm/security/advisories/GHSA-hgg8-fqqc-vfmw
- nvd.nist.gov/vuln/detail/CVE-2026-54236
- pypi.org/project/vllm
Code Behaviors & Features
Detect and mitigate CVE-2026-54236 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →