Inference infrastructure

CVE-2026-24215 affects the DALI backend of NVIDIA Triton Inference Server. An attacker could cause uncontrolled resource consumption, which might lead to denial of service. NVD has not yet provided an assessment, and the source names no affected versions.

NVIDIA Triton Inference Server contains a path traversal vulnerability, classified as CWE-22, that an attacker could trigger. A successful exploit might lead to denial of service. NIST has not yet provided an NVD assessment, and the source does not list affected versions.

GHSA-v6qf-75pr-p96m affects Open WebUI. The bypass_filter parameter in the generate_chat_completion handlers in routers/openai.py and routers/ollama.py is bound from the query string by FastAPI, so an authenticated user can append ?bypass_filter=true to /openai/chat/completions or /ollama/api/chat. This skips the model access control check, letting any authenticated user invoke admin-restricted models through the server's configured connections.

Researchers disclosed CVE-2026-7482 (CVSS 9.1), a heap out-of-bounds read in the GGUF model loader of Ollama before 0.17.1, codenamed Bleeding Llama by Cyera. A remote, unauthenticated attacker can upload a crafted GGUF file with an inflated tensor shape to the /api/create endpoint, leaking process memory such as environment variables, API keys, system prompts and other users' conversation data, which can then be pushed to an attacker-controlled registry via /api/push. The flaw likely affects over 300,000 servers.

Cyera researchers disclosed CVE-2026-7482, dubbed Bleeding Llama, an out-of-bounds heap read in Ollama's model quantization pipeline triggered when GGUF files declare larger tensor sizes than their data. An unauthenticated attacker can upload a crafted file to the Ollama API endpoint and leak process memory, including system prompts, user messages and environment variables. The researchers estimate about 300,000 Ollama servers are exposed on the public internet.

A shape regression in vLLM's extract_hidden_states speculative decoding proposer, introduced when the KV connector interface was refactored in PR #37013, causes a RuntimeError that crashes the EngineCore process. Any request containing repetition_penalty, frequency_penalty, or presence_penalty triggers the crash, affecting deployments from v0.18.0 through v0.19.1 inclusive.

Unauthenticated text-only prompts in vLLM that spell special tokens such as <|image_pad|> are interpreted as control tokens. When image or video placeholders arrive without matching data, get_input_positions_tensor in vllm/model_executor/layers/rotary_embedding.py indexes empty image_grid_thw/video_grid_thw grids without a bounds check, raising an unhandled IndexError that can terminate the worker. Reproduced on vLLM 0.10.0 with Qwen2.5-VL; a single request can trigger it.

Cyera reports that a heap out-of-bounds read in Ollama's GGUF model loader, tracked as CVE-2026-7482 (CVSS 9.3) and dubbed Bleeding Llama, can be exploited without authentication to read sensitive heap data such as prompts, messages and environment variables. An attacker supplies a GGUF file with a tensor offset and size larger than the file, then uses Ollama's model push feature to exfiltrate the result, requiring three unauthenticated API calls. Cyera estimates about 300,000 Ollama servers are exposed on the public internet.

A vulnerability in vllm up to 0.19.0 affects the function has_mamba_layers in vllm/v1/kv_cache_interface.py, part of the KV Block Handler component. Manipulating it leads to an uninitialized resource, and the attack can be launched remotely. The attack is rated high complexity and difficult to exploit, but a public exploit exists.

A path traversal flaw has been reported in Ollama up to 0.20.2, in the digestToPath function of x/imagegen/transfer/transfer.go within the Tensor Model Transfer Handler component. Manipulating the digest argument enables the traversal, and the attack can be launched remotely but has high complexity and is reported as difficult to exploit. A public exploit exists, and the vendor did not respond to early disclosure.