vLLM Security Advisory: Internal Path Disclosure via Error Messages

The vLLM project has disclosed a medium-severity vulnerability, according to the GitHub Security Advisory database, involving unauthenticated disclosure of internal paths and usernames through validation error messages. When the vLLM API encounters a malformed request, FastAPI raises a `RequestValidationError`, which is converted into a string by the `validation_exception_handler`. This process exposes sensitive internal details such as the OS username, home directory path, virtual environment path, Python version, and internal package structure, including handler function names and line numbers. This information could be exploited by attackers to construct targeted exploits.

Operators should assess whether their vLLM deployment is exposed to unauthenticated users or accessible over public networks. If so, this vulnerability could pose a significant risk, especially if the `/version` endpoint is disabled, as attackers could still fingerprint the exact version via leaked handler function names. Before upgrading or applying mitigations, ensure that no reverse proxy configurations are inadvertently rewriting error responses in a way that could interfere with the remediation options provided.