Memory Address Leak in vLLM via Image Handling

Executive Summary

This vulnerability affects vLLM, an inference and serving engine for large language models. Before version 0.23.1rc0, a fix for a previous issue (CVE-2026-22778) was incomplete. Specifically, some response paths in the software send error messages directly to clients without properly sanitizing them. These error messages can include memory addresses from the server's heap, which are leaked because the sanitize_message helper is not called in these cases.

An unauthenticated attacker can exploit this by sending malformed image bytes through the Anthropic Messages API. This causes an error (UnidentifiedImageError) that includes a memory address in its message, which is then exposed in the response body. This leak of heap memory addresses can reveal sensitive internal information about the server.

The vulnerability is fixed in version 0.23.1rc0 by ensuring all error messages are properly sanitized before being sent to clients.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by leaking internal memory addresses of the server to unauthenticated attackers. Such information disclosure can aid attackers in further exploiting the system by providing insights into the server's memory layout.

Although the vulnerability does not directly allow modification or denial of service, the information leak can be a stepping stone for more severe attacks.

Since the vulnerability can be exploited remotely without authentication, it increases the risk exposure of systems running vulnerable versions of vLLM.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade vLLM to version 0.23.1rc0 or later, where the issue is fixed.

The vulnerability arises because several response paths bypass the sanitize_message helper, allowing memory addresses to leak in error messages. Ensuring you are running the fixed version will prevent this information leakage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability involves the exposure of sensitive memory addresses in error messages returned by the vLLM Anthropic API router and related endpoints. Such leakage of sensitive information can be classified under CWE-532 (sensitive information exposure).

Exposure of sensitive internal memory addresses could potentially increase the risk of further exploitation, which may impact the confidentiality and integrity of data processed by the system.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, leaking sensitive internal information could be considered a violation of data protection principles under these regulations, especially if such information could lead to unauthorized access or compromise of personal data.

Therefore, organizations using affected versions of vLLM should consider this vulnerability as a risk to compliance with data protection regulations and apply the provided fixes promptly to mitigate exposure.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the error responses from the Anthropic API router endpoints, the Server-Sent Events streaming converter, and the realtime speech-to-text WebSocket connections in the vLLM service. Specifically, look for error messages that contain raw memory addresses, such as representations of BytesIO objects (e.g., <_io.BytesIO object at 0x7a95e299e750>) in the response body.

To detect this on your system, you can send malformed image data to the affected API endpoints (POST /v1/messages and POST /v1/messages/count_tokens) and observe if the error responses leak memory addresses in their messages.

Example commands to test this might include using curl or similar HTTP clients to send malformed image bytes to the Anthropic API endpoints and inspecting the JSON error responses for unsanitized memory addresses.

• curl -X POST https://your-vllm-instance/v1/messages -H 'Content-Type: application/json' -d '{"image_content": "malformed_image_bytes_here"}'
• curl -X POST https://your-vllm-instance/v1/messages/count_tokens -H 'Content-Type: application/json' -d '{"image_content": "malformed_image_bytes_here"}'

After sending such requests, check the response body for error messages containing raw memory addresses or BytesIO object representations, which indicate the vulnerability is present.

Useful 0 Not Useful 0