Information Exposure Through an Error Message in vLLM - #VU139886

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to generation of error messages containing sensitive information in validation_exception_handler in vllm/entrypoints/openai/server_utils.py when handling malformed JSON requests or requests missing required fields. A remote attacker can send a specially crafted malformed request to disclose sensitive information.

Exposed details may include the operating system username, home directory path, virtual environment path, Python version, internal package structure, line numbers, and handler function names for affected endpoints.

Affected software

Remediation

External References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-hwrm-c4cx-rf4j
• https://github.com/vllm-project/vllm/commit/e87521626f

Related Security Bulletins

• Multiple vulnerabilities in vLLM