Database/AI/ML frameworks & serving
vLLM: malformed JSON to the OpenAI-compatible endpoints returns server paths and versions
Impact
FastAPI validation errors are stringified straight into the response and the sanitizer does not strip traceback-style file paths, so a malformed request to /v1/chat/completions, /v1/completions, /tokenize or /detokenize returns the OS username the server runs as, home and virtualenv paths, the Python version, internal package structure with line numbers, and handler names. No model weights, prompts or other tenants' output are exposed. The value is reconnaissance: it pins down the exact vLLM build and the account it runs under before an attacker tries anything heavier against the same endpoint, and on a fleet it makes it trivial to find which servers are behind on patching.
Who can reach it
Anyone who can send HTTP to the vLLM server. Unauthenticated in the common deployment where no API key is configured; where an inference endpoint is published per tenant, any tenant can do this against endpoints they reach.
What to do
Upgrade to vLLM 0.26.0 and restart each server process, rolling through the inference deployment. No node drain or reboot. Where an upgrade has to wait, an intermediate proxy that rewrites 422 bodies removes the disclosure without touching the servers.
References
Related entries
- vLLM: attacker-supplied structured-output regex pins a CPU core and stalls the engine pathCVE-2026-73556 · vLLM structured outputs, lm-format-enforcer backend (structured_outputs.regex)Medium
- vLLM: integer overflow in the activation CUDA kernel leaks another batched request's outputCVE-2026-73558 · vLLM CUDA activation kernels (act_and_mul_kernel, activation_kernels.cu)Medium
- vLLM (DeepStream video backend, VideoMediaIO backend selection): A performance feature merged past two existingNCVD-2026-044-vllm-deepstream-video-backend-vi · vLLM (DeepStream video backend, VideoMediaIO backend selection)Medium
- NVIDIA OpenShell for Linux: improper output encoding in the inference proxy leaks data and allows tamperingCVE-2026-65085 · NVIDIA OpenShell for Linux (inference proxy)Medium
- Pure Storage FlashArray key rotation logging (Rapid Data Locking): The Key Encryption Key is written to logs duringCVE-2025-2327 · Pure Storage FlashArray key rotation logging (Rapid Data Locking)Medium
- JupyterLab: stored XSS from javascript: URLs in extension metadata shown by Extension ManagerCVE-2026-67338 · JupyterLab Extension Manager (package metadata URL protocol validation)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.