vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak

vLLM = 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitizemessage to the OpenAI router but the Anthropic-compatible router /v1/messages echoes strexc directly. id: CVE-2026-54236 info: name: vLLM = 0.23.0 - Anthropic Router Heap Address Information Leak author: kenlacroix...

CVE-2026-54236 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-12.9, vllm-openai-cuda-13.0, tritonserver-backend-vllm-cuda-13.0, vllm-cuda-13.2...