CVE-2026-73555: Vllm

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.

Affected products

• Vllm Vllm: before 0.26.0 (fixed in 0.26.0)

Published 2026-08-13. Last modified 2026-10-02.