CVE-2026-126395 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
vLLM's error sanitizer misses uppercase memory addresses in image-processing errors, so a crafted PNG sent to endpoints such as /tokenize can make the server reveal live heap addresses. An attacker can use those addresses to defeat address space layout randomization, which is a step toward a larger memory-corruption attack.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running vLLM from 0.14.0rc1 up to but not including 0.31.0 that expose its HTTP API, especially endpoints that accept image input such as /tokenize. Deployments that keep vLLM on a private network with no untrusted callers are lower risk. unknown for further detail beyond the sources.
Not affected if default-config, private-network-only
Who cares ai-inference, python, self-hosted, vllm
pip show vllm and compare it with the fixed version in the product ranges./tokenize reachable from untrusted networks.0.31.0 or later, per the affected range before 0.31.0.vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.