---
id: "CVE-2026-126395"
page: "https://infrastack.ai/live/CVE-2026-126395"
kind: "vulnerability"
aliases: ["CVE-2026-126395"]
title: "vLLM: error messages leak heap addresses, helping attackers bypass memory protection"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-inference", "ai-tooling", "python", "self-hosted", "vllm"]
not_affected_if: ["default-config", "private-network-only"]
published_at: "2026-11-13T10:17:43+00:00"
first_seen_at: "2026-11-13T10:47:18+00:00"
updated_at: "2026-11-13T10:54:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126395", "first_seen_at": "2026-11-13T10:47:18+00:00"}]
exploit_sources: []
---

# vLLM: error messages leak heap addresses, helping attackers bypass memory protection

Link for people: https://infrastack.ai/live/CVE-2026-126395 (this .md is for agents)

vLLM's error sanitizer misses uppercase memory addresses in image-processing errors, so a crafted PNG sent to endpoints such as /tokenize can make the server reveal live heap addresses. An attacker can use those addresses to defeat address space layout randomization, which is a step toward a larger memory-corruption attack.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed vLLM version with `pip show vllm` and compare it with the fixed version in the product ranges.
- Look for exposed vLLM HTTP endpoints such as `/tokenize` reachable from untrusted networks.

## Fix

- vLLM: upgrade to `0.31.0` or later, per the affected range before `0.31.0`.

## Timeline

- 2026-11-13T10:47:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126395

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-m9fg-w9qh-67pc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vllm-0.14-0rc1-before-0.31.0-heap-address-disclosure-via-sanitize-message

## From the sources

vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_