Inference infrastructure

vLLM, an inference and serving engine for large language models, contains a flaw from 0.20.2rc0 through 0.26.0 in safe_load_prompt_embeds in vllm/renderers/embed_utils.py. The function toggles the process-global torch.sparse.check_sparse_tensor_invariants setting, and concurrent prompt_embeds parts submitted to POST /v1/chat/completions can race that state, letting an invalid sparse tensor reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled.

CVE-2026-65315 affects Ollama at HEAD f0078ae. The GGUF metadata parser allocates memory based on attacker-controlled length, count and dimension fields without checking them against the remaining file size. A remote attacker can upload a crafted GGUF file under 1KB through the blob upload, model create or pull API endpoints, causing an unrecoverable Go out-of-memory fatal error or makeslice panic. Because these bypass recovery middleware, the entire server process crashes.

CVE-2026-63086 affects text-generation-inference through 3.3.7. Its OpenAI-compatible multimodal chat completions endpoint lacks validation in fetch_image (router/src/validation.rs), so an unauthenticated attacker can supply a crafted image_url and make the server send arbitrary HTTP GET requests. Because the reqwest client follows redirects by default, redirect chains can bypass scheme checks and reach private, loopback, link-local and cloud metadata addresses for internal port scanning and credential theft.

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization. A local, unauthenticated attacker could cause deserialization of untrusted data (CWE-502), which might lead to code execution, escalation of privileges, data tampering, and information disclosure.

CVE-2026-47482 affects NVIDIA Triton Inference Server for Linux. An attacker can cause missing release of memory after effective lifetime, classified as CWE-401. A successful exploit might lead to denial of service. NVD has not yet provided an assessment.

NVIDIA Triton Inference Server for Linux contains a vulnerability, CVE-2026-47480, in which an attacker can cause an uncaught exception. The source states that a successful exploit might lead to denial of service. The weakness is classified as CWE-248 (Uncaught Exception), and NVD had not yet provided an assessment at publication on 07/14/2026.

NVIDIA Triton Inference Server for Linux contains a vulnerability, tracked as CVE-2026-47479 and classified as CWE-400 (Uncontrolled Resource Consumption). An attacker can cause uncontrolled resource consumption, which might lead to denial of service. NIST has not yet provided an NVD assessment, and the CVE was published on 07/14/2026.

NVIDIA Triton Inference Server for Linux contains a vulnerability, tracked as CVE-2026-47478 and classified as CWE-910 (Use of Expired File Descriptor). An attacker can cause the server to use an expired file descriptor, which might lead to denial of service.

CVE-2026-47477 affects NVIDIA Triton Inference Server for Linux. An attacker can cause a stack-based buffer overflow (CWE-121) in it, which might lead to denial of service. NVD has not yet provided an assessment, and the source gives no affected versions.

NVIDIA Triton Inference Server for Linux contains a vulnerability, CVE-2026-47476, classified as CWE-400 Uncontrolled Resource Consumption. An attacker can cause uncontrolled resource consumption, which might lead to denial of service. The NVD published the entry on 07/14/2026.

CVE-2026-15574 affects the vllm-orchestrator-gateway component. Its production binary writes all incoming authorization headers and full chat payloads to persistent logs, including bearer tokens, personally identifiable information and secrets. Any user with logging privileges can read this data, which may let an attacker harvest credentials and conversation content.