CVE-2026-73555

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Published

Aug 13, 2026, 2:50:03 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.41% · Oct 25, 2026

A flaw was found in vLLM, an inference and serving engine for large language models. Unauthenticated attackers can send malformed JSON requests to various API endpoints, triggering validation errors. The system's error handling mechanism converts these validation errors into strings without properly sanitizing traceback-style file paths. This vulnerability allows for the disclosure of sensitive internal system information, including the operating system username, home and virtual environment paths, Python version, internal package structure, and handler function names. vllm: vLLM: Information Disclosure via Validation Error Messages Moderate: vLLM, as deployed in Red Hat AI Inference Server and Red Hat OpenShift AI, is susceptible to information disclosure. Unauthenticated, malformed JSON requests to its API endpoints can expose sensitive system details, including OS usernames, file paths, Python version, and internal package structure, due to insufficient sanitization of validation error messages. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.