CVE-2026-73555: vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_e…
- Occurred
- Aug 13, 2026
- Published
- Aug 13, 2026
- Source
- NVD CVE
Summary
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.
Tags
- CVE
- CVE-2026-73555
- cvss:MEDIUM
Classification
Rationale: Unauthenticated disclosure of OS paths and internal system details via malformed requests.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8