CVE-2026-54236: 
NixOS vulnerability analysis and mitigation

CVE-2026-54236 is an information disclosure vulnerability in vLLM (an inference and serving engine for large language models) that represents an incomplete fix for CVE-2026-22778. Discovered by researcher Kai Aizen (SnailSploit) and published on June 11, 2026, it affects all vLLM versions up to and including 0.23.0. The vulnerability allows unauthenticated attackers to leak heap memory addresses via unsanitized exception messages returned by the Anthropic API router, SSE streaming converter, and realtime speech-to-text WebSocket endpoints. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, vLLM Security Advisory).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File / Error Message). The prior fix for CVE-2026-22778 introduced a sanitize_message helper that strips Python object-repr memory addresses (e.g., <_io.BytesIO object at 0x7a95e299e750>) from error messages, but this helper was only applied to the OpenAI router's FastAPI exception handlers. Five additional response paths — in vllm/entrypoints/anthropic/api_router.py (POST /v1/messages and POST /v1/messages/count_tokens), vllm/entrypoints/anthropic/serving.py (SSE streaming), and vllm/entrypoints/speech_to_text/realtime/connection.py (WebSocket, two sites) — catch exceptions in-route and return str(exc) directly, bypassing the global sanitizing FastAPI exception handler entirely; WebSocket frames bypass it for a separate architectural reason. An unauthenticated attacker sends malformed image bytes as an Anthropic Messages API image content part, causing PIL.Image.open to raise an UnidentifiedImageError whose message contains the BytesIO object repr with a verbatim heap address, which is then echoed in the error.message field of the JSON response (vLLM Security Advisory, Fix PR #45119).

Successful exploitation leaks a heap memory address to an unauthenticated remote attacker, reducing ASLR entropy on the affected process from approximately 4 billion candidates to approximately 8 — the same partial ASLR-bypass primitive as the parent CVE-2026-22778. On its own, this vulnerability has a confidentiality-only impact with no integrity or availability consequences. However, on deployments running vLLM alongside an older OpenCV/libopenjp2 (e.g., system OpenCV on long-LTS distributions or custom Docker images), this Stage 1 leak can be chained with the Stage 2 libopenjp2 heap overflow from CVE-2026-22778 to achieve remote code execution (vLLM Security Advisory).

No confirmed in-the-wild exploitation has been observed, and no standalone weaponized exploit script is publicly available. The NVD SSVC assessment classifies exploitation as "poc" and the attack as automatable. A Metasploit module scanner was proposed (rapid7/metasploit-framework#21593) and a Nuclei template was added in projectdiscovery/nuclei-templates v10.4.5, indicating active tooling development. The EPSS score is approximately 0.82% (52nd percentile). The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing vLLM instances running version ≤ 0.23.0 with the Anthropic API endpoint enabled (e.g., via Shodan, Censys, or service fingerprinting on the default vLLM port).
2. Craft malformed image payload: Prepare a byte sequence that is not a valid image format (e.g., random bytes or a truncated JPEG header) and base64-encode it.
3. Send malformed request: Submit an HTTP POST to /v1/messages with a JSON body containing an image content part using the malformed base64 data:

{
  "model": "<any-model>",
  "messages": [{
    "role": "user",
    "content": [{
      "type": "image",
      "source": {"type": "base64", "media_type": "image/jpeg", "data": "<malformed-base64>"}
    }]
  }]
}

4. Receive leaked address: The server returns an HTTP 500 JSON response with error.message containing the PIL.UnidentifiedImageError string, e.g., "cannot identify image file <_io.BytesIO object at 0x7a95e299e750>" — the hex value is the heap address.
5. Reduce ASLR entropy: Repeat requests to confirm the address and reduce ASLR candidates from ~4 billion to ~8, enabling a follow-on heap exploitation chain if a vulnerable libopenjp2 is present (vLLM Security Advisory).

• Network: Repeated HTTP POST requests to /v1/messages or /v1/messages/count_tokens with image content parts containing invalid or minimal base64-encoded data; HTTP 500 responses from the vLLM server containing 0x hex addresses in the JSON body.
• Logs: vLLM application logs showing repeated Error in create_messages or Error in message stream converter exceptions with PIL.UnidentifiedImageError tracebacks from the same source IP.
• WebSocket: Repeated WebSocket connections to the realtime speech-to-text endpoint followed by processing_error frames containing 0x-prefixed hex strings in the error payload.
• Response Body Pattern: JSON responses with error.message matching the pattern cannot identify image file <_io.BytesIO object at 0x[0-9a-f]+> (vLLM Security Advisory).

Upgrade vLLM to version 0.24.0 or later (the fix was merged in PR #45119 and included from 0.23.1rc0 onward), which applies sanitize_message() to all five affected error response sites (Fix PR #45119, Fix Commit). As a network-level workaround for deployments that cannot immediately upgrade, restrict access to the vLLM Anthropic API endpoints (/v1/messages, /v1/messages/count_tokens, and the realtime WebSocket) to authorized clients only using firewall rules or an API gateway. Additionally, ensure OpenCV ≥ 4.13.0 is installed to prevent the Stage 2 RCE chain from being re-enabled via this leak primitive (vLLM Security Advisory).

The vulnerability was discovered by Kai Aizen (SnailSploit) of Adversarial & Offensive Security Research and coordinated through GitHub's security advisory process. A blog post and Mastodon post by security researcher Deniz Halil (denizhalil.com) covered the technical details on June 23, 2026. A Nuclei template for automated detection was added to the projectdiscovery/nuclei-templates repository in release v10.4.5, and a Metasploit scanner module was proposed (rapid7/metasploit-framework#21593), reflecting active community interest in tooling for this vulnerability (vLLM Security Advisory, Fix PR #45119).