vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak

vLLM = 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitizemessage to the OpenAI router but the Anthropic-compatible router /v1/messages echoes strexc directly. id: CVE-2026-54236 info: name: vLLM = 0.23.0 - Anthropic Router Heap Address Information Leak author: kenlacroix...

CVE-2026-54236 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-13.0, vllm-cuda-13.2, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +209 more potentially affected by CVE-2026-54236 via vllm (>=0.1.3, <=0.28.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.1, =0.0.0, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =1.0.0, =0.2.0, =0.3.0 and more Source cves: CVE-2026-54236 Source advisory: SNYK:PYTHON-VLLM-17372791...