GHSA-hwrm-c4cx-rf4j: Medium severity pip/vllm vulnerability
Summary
When the vLLM API receives a malformed request (e.g., invalid JSON or missing required fields), FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via str(exc), which includes the internal file path and line number of the handler function. The existing sanitizemessage() function in vllm/entrypoints/utils.py strips memory addresses (e.g., 0x7f...) but does not strip File "...", line X patterns. The result is a user-facing HTTP response that leaks internal system information.
Impact
An unauthenticated attacker can extract the following with a single malformed request:
- OS username running the vLLM process (e.g., ubuntu) - Home directory path (e.g., /home/ubuntu/) - Virtual environment path (e.g., vllm-env/) - Python version (e.g., 3.12) - Internal package structure and line numbers (e.g., vllm/entrypoints/openai/chatcompletion/apirouter.py) - Handler function names per endpoint, enabling precise version fingerprinting
This information aids attackers in constructing targeted exploits: environment paths narrow the attack surface, and handler function names + line numbers enable exact version identification even when the /version endpoint is disabled.
All POST endpoints that accept JSON bodies are affected, including /v1/chat/completions, /v1/completions, /tokenize, and /detokenize.
Workarounds
Deploying vLLM behind a reverse proxy that rewrites error response bodies to strip file paths would mitigate this, though it is fragile.
Remediation Recommendation
Two possible fixes (either suffices):
Option A — Fix validationexceptionhandler: Construct the error message from exc.errors() (the structured Pydantic error list) rather than str(exc). This avoids the traceback-style string entirely.
Option B — Fix sanitizemessage: Add a regex to strip File "...", line \d+ patterns, similar to how memory addresses are already stripped:
python import re msg = re.sub(r'File ".?", line \d+, in \w+', '[internal]', msg)
Option A is preferred as it addresses the root cause rather than filtering symptoms.
Environment Tested
- vLLM 0.20.1 (pip install, latest stable as of May 2026) - Python 3.12 - Ubuntu 22.04 - Model: Qwen/Qwen2-0.5B (text-only; bug is model-independent)
This was fixed here: https://github.com/vllm-project/vllm/commit/e87521626f
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.26.0 - Configuration
Update `validation_exception_handler` in `vllm/entrypoints/openai/server_utils.py` to construct the error message from `exc.errors()` rather than calling `str(exc)` (root-cause fix described; referenced as fixed by vLLM commit `e87521626f`).
vLLM (FastAPI error handling) validation_exception_handler error message construction = Use exc.errors() (structured Pydantic error list) instead of str(exc) - Configuration
Update `sanitize_message()` in `vllm/entrypoints/utils.py` to add a regex that strips `File "...", line \d+` patterns (example given: `re.sub(r'File ".*?", line \d+, in \w+', '[internal]', msg)`).
vLLM (message sanitization) sanitize_message regex filtering = Strip `File "...", line \d+` patterns - Compensating control
Deploy vLLM behind a reverse proxy that rewrites error response bodies to strip internal file paths (workaround mentioned as mitigating the information leak, though fragile).
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can trigger the information disclosure if they can send requests to the vLLM API. Authentication is not required.
What must an attacker do to obtain the leaked information?
The attacker needs to submit a malformed request, such as invalid JSON or a request missing required fields. A single malformed request can cause the HTTP response to expose internal path, runtime, and handler details.
How can I determine whether an exposed API is leaking this information?
Send a malformed request to the vLLM API and inspect the resulting validation-error HTTP response. An affected response can include file paths, line numbers, the process username or home directory, Python environment details, and endpoint handler names.