{"cve_id":"CVE-2026-54236","title":"vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak","severity":"medium","actively_exploited":false,"patterns":["/v1/messages"],"events":24,"unique_ips":4,"actors":[{"ip":"204.76.203.6","events":15,"country_code":"NL","country":"Netherlands","org":"Pfcloud UG (haftungsbeschrankt)","rdns":"204.76.203.6.ptr.pfcloud.network","scanner_tag":null},{"ip":"5.61.209.224","events":6,"country_code":"SC","country":"Seychelles","org":"Amarutu Technology Ltd","rdns":"","scanner_tag":null},{"ip":"185.150.191.236","events":2,"country_code":"US","country":"United States","org":"ReliableSite.Net LLC","rdns":"","scanner_tag":null},{"ip":"104.243.32.235","events":1,"country_code":"US","country":"United States","org":"ReliableSite.Net LLC","rdns":"","scanner_tag":null}],"top_asns":[{"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","events":15,"ips":1},{"asn":206264,"org":"Amarutu Technology Ltd","events":6,"ips":1},{"asn":23470,"org":"ReliableSite.Net LLC","events":3,"ips":2}],"fingerprints":{"ja4h":["ge11nn0700_131b6413da1e","po11nn0700_514b9e9e76d1","po11nn0500_0b7edda7ea97"],"ja4":["t13i5910h1_a33745022dd6_1f22a2ca17c4"]},"sample_paths":["/anthropic/v1/messages","/v1/messages"],"timeline":[{"day":"2026-05-18","events":15,"ips":1},{"day":"2026-06-12","events":3,"ips":2},{"day":"2026-07-23","events":6,"ips":1}],"window_hours":2160}