Database/AI/ML frameworks & serving
vLLM: error messages leak live server heap addresses to unauthenticated clients
Impact
The regex in sanitize_message() only scrubs lowercase PIL image addresses, so uppercase ones get through. A crafted PNG sent to endpoints such as /tokenize makes the HF processor fail, and the error returned to the client contains live heap addresses from the serving process. The leak alone gives no code execution or data access. What it does give is an ASLR bypass, which makes any separate memory-corruption bug in the same vLLM process easier to exploit. That matters most on inference endpoints exposed to many tenants or to the internet.
Who can reach it
Anyone who can reach the vLLM HTTP API, for example /tokenize. No authentication is needed if the deployment does not enforce any. The model must accept image input.
What to do
Upgrade vLLM to 0.31.0 or later, which affects 0.14.0rc1 through 0.30.x, and restart the serving process. That means rolling each inference replica, which drops in-flight requests and reloads model weights. Until then, put authentication in front of the API and avoid sending raw processor errors back to untrusted clients.
References
Related entries
- vLLM: unchecked min_pixels in MiniMax M3 VL video processing exhausts host CPU and memoryCVE-2026-126396 · vLLM (MiniMax M3 VL video processor, mm_processor_kwargs)Medium
- Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium
- stable-diffusion.cpp: safetensors loader trusts data_offsets, reading process memory past the tensor data sectionCVE-2026-70660 · stable-diffusion.cpp safetensors loader (src/model_io/safetensors_io.cpp)Medium
- llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
- llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
- BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.