MediumVulnerabilityLLM-specific
CVE-2026-27765: vLLM Hardware Plugin for Intel Gaudi denial of service
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-27765
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.1%
Summary
Improper input validation in some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0, within Ring 3: User Applications, may allow a denial of service. An authenticated adversary can exploit it with a low complexity attack via local access, requiring no user interaction. The impact is high availability on the vulnerable system, with no confidentiality or integrity impact.
Mitigation
Fixed in version 0.16.0.
Topics
Related items
- MediumEndor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Endor LabsSimilar attack · Endor Labs Blog
- MediumCVE-2026-44627: Intel oneDNN integer overflow to buffer overflow in Ring 3 user applicationsSimilar attack · NVD/CVE Database
- MediumGHSA-h7c4-q426-7jh9: tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clientsSimilar attack · GitHub Advisory Database
- HighGHSA-4p8p-pjpq-2w7h: tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP processSimilar attack · GitHub Advisory Database
- HighGHSA-447x-qqwf-m7xq: tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoSSimilar attack · GitHub Advisory Database