CVE-2026-73555

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0

Description An issue exists where the validation exception handler in vllm/entrypoints/openai/server utils.py converts FastAPI RequestValidationError objects using str(exc), and the sanitize message function in vllm/entrypoints/utils.py fails to remove traceback-style file paths. This allows unauthenticated users to send malformed JSON requests to the '/v1/chat/completions', '/v1/completions', '/tokenize', and '/detokenize' endpoints to disclose sensitive information, including the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names.

Recommendations Update vLLM to version 0.26.0.