The CVSS 5.3 for CVE-2026-73555 is defensible in isolation but dangerously misleading in practice. The vulnerability exposes a reconnaissance asymmetry: the information disclosed — OS username, home directory path, venv structure, Python version, handler function names, and internal line numbers — is individually low-value, but their combination creates a precise system fingerprint that transforms an unauthenticated API probe into a targeted attack plan.
The failure lives in vLLM's sanitize_message() function, which strips certain content from error responses but leaves traceback artifacts intact. FastAPI's RequestValidationError works correctly by preserving debugging context; the gap is that vLLM's sanitization layer never applied a default-deny policy to path disclosure. The result is that any malformed request to a vLLM endpoint returns a structured fingerprint of the server's internals.
This matters disproportionately for inference infrastructure. The disclosed handler names and filesystem paths don't just map attack surface — they reveal where the inference pipeline lives, enabling targeted probing for prompt injection vectors, KV cache manipulation, and model weight access paths that don't exist in standard web services. An attacker who knows the handler structure can begin chaining toward follow-on vulnerabilities that would individually score much higher.
Worse, this is the fourth such disclosure in Python inference tooling within eighteen months, each scored independently as medium or low. No CVE analyst can flag that the aggregate creates a cumulative dossier — but a motivated actor who encounters two or three of these against a target stack has reconstructed the entire development pipeline's structure without firing a meaningful exploit. The CVSS model prices each incident in isolation and cannot see its own genealogy.
After disclosure, the exposure window shifts. Before the CVE, the vulnerability required finding a vLLM instance first — opportunistic scanning wouldn't catch it. After disclosure, every automated exploitation framework has a signature. The EPSS score of 0.00255 reflects the pre-disclosure era; it says nothing about post-disclosure weaponization.
The fix in vLLM 0.26.0 almost certainly adds a regex to catch the reported traceback pattern. What it almost certainly does not do is audit the other exception handlers in the entrypoint module or challenge the underlying assumption that production inference engines should surface detailed error context to clients at all. That architectural question — content filtering versus context design — is where the real exposure lives, and it's not captured by any CVSS score.