CVE-2026-126395
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass.