CVE-2026-126395

The vLLM library (versions 0.14.0rc1 before 0.31.0) is vulnerable to a heap address disclosure in the sanitize_message() function. The root cause is a lowercase-only regex that fails to scrub uppercase PIL image addresses. Unauthenticated attackers can exploit this by sending a crafted PNG to end...

EUVD-2026-125170

vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitizemessage whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak...

CVE-2026-73555

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...