Inference infrastructure

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, letting authenticated clients bypass duration checks. An attacker can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process, affecting all tenants.

vLLM versions 0.10.2 up to but not including 0.28.0 apply no audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. The _extract_audio_from_videos function in nano_nemotron_vl.py calls load_audio_pyav without the max_duration_s or max_decode_bytes parameters, so VLLM_MAX_AUDIO_DECODE_DURATION_S and VLLM_MAX_AUDIO_DECODE_BYTES are not enforced. When such a model is served with use_audio_in_video=True, an attacker supplying a small, highly compressed video can make the server allocate gigabytes of memory during audio decoding, causing a denial of service.

CVE-2026-86289 affects Ollama up to 0.31.1. An integer overflow in the readGGUFV1String function of fs/ggml/gguf.go, in the GGUF Decoder component, can be triggered remotely. A public exploit exists.

vLLM versions up to and including 0.17.0 are affected by CVE-2026-37237. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs with aiohttp and call r.read() without enforcing a maximum response size. A remote attacker can exhaust server memory by supplying a URL to an arbitrarily large file, causing a Denial of Service.

CVE-2026-78684 affects vLLM before 0.27.0, which fails to classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. An unauthenticated attacker can activate DeepStream at request time, initialize the process-wide GPU decode pool, and submit video that bypasses resource controls, causing partial denial of service for concurrent requests. VulnCheck rates it CVSS 4.0 6.9 (MEDIUM); NVD has not yet provided an assessment.

NVIDIA Triton Inference Server for Linux contains an absolute path traversal vulnerability, tracked as CWE-36. A successful exploit might lead to code execution. The NVD assessment has not yet been provided, and NVIDIA published the advisory under its product-security repository.

NVIDIA Triton Inference Server for Linux contains an absolute path traversal vulnerability, tracked as CWE-36. A successful exploit might lead to code execution and information disclosure. NVD has not yet provided an assessment.

vLLM, an inference and serving engine for large language models, is affected prior to version 0.26.0. The MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get and Image.open instead of MediaConnector, which bypasses the allowed_media_domains and allowed_local_media_path protections. This allows server-side requests and reads of arbitrary files accessible to the vLLM process.

vLLM versions prior to 0.26.0 expose the /v1/completions/derender and /v1/chat/completions/derender endpoints, which accept caller-supplied GenerateResponse objects. The OnlineDerenderer and tokenizer.decode process these structures before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, so an authenticated API client can consume excessive CPU and memory and produce oversized responses.

vLLM versions 0.19.0 through 0.26.0 accept an unbounded list of prompts in the /v1/completions CompletionRequest.prompt field. The preprocessing path and serving code create one engine generator and response slot per prompt, so a single request from an authenticated API client can exhaust CPU, memory, async scheduling capacity, engine request slots and response buffering.

CVE-2026-73558 affects vLLM, an inference and serving engine for large language models, prior to 0.27.0. An integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input. A request in the same inference batch may then receive a partial or complete copy of another user's inference result.