Inference infrastructure

CVE-2026-24146 affects NVIDIA Triton Inference Server. Insufficient input validation combined with a large number of outputs can crash the server, which a successful exploit may use to cause denial of service. The source tags the weakness as CWE-789, Memory Allocation with Excessive Size Value.

CVE-2026-27893 affects vLLM, an inference and serving engine for large language models, from version 0.10.1 before 0.18.0. Two model implementation files hardcode `trust_remote_code=True` when loading sub-components, overriding a user's explicit `--trust-remote-code=False` opt-out. This enables remote code execution through malicious model repositories even when remote code trust is disabled.

CVE-2026-24158 affects the HTTP endpoint of NVIDIA Triton Inference Server. An attacker can cause a denial of service by sending a large compressed payload, and a successful exploit may lead to denial of service. The weakness is classified as CWE-789, Memory Allocation with Excessive Size Value.

NVIDIA Triton Inference Server contains a vulnerability, CVE-2025-33254, where an attacker may cause internal state corruption. A successful exploit may lead to a denial of service. The weakness is classified as CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition').

NVIDIA Triton Inference Server's Sagemaker HTTP server contains a vulnerability, tracked as CVE-2025-33238, that lets an attacker cause an exception. A successful exploit may lead to denial of service. The weakness is classified as CWE-362, a race condition from concurrent execution using a shared resource with improper synchronization. NVD has not yet provided an assessment.

CVE-2026-0599 affects huggingface/text-generation-inference version 3.3.6. Unauthenticated remote attackers can trigger unbounded external image fetching during input validation in VLM mode, because the router performs a blocking HTTP GET on Markdown image links and reads the entire response into memory. This can exhaust network bandwidth, memory and CPU, and the default deployment, which lacks memory limits and authentication, could crash the host machine.

CVE-2026-24779 affects vLLM versions prior to 0.14.1. The `MediaConnector` class in its multimodal feature set has an SSRF flaw in the `load_from_url` and `load_from_url_async` methods, where two Python parsing libraries interpret backslashes differently, letting an attacker bypass the host name restriction. A successful attacker can make the vLLM server send arbitrary requests to internal network resources, which is especially serious in containerized deployments such as `llm-d`.

CVE-2025-15063 is a command injection flaw in the execAsync method of the Ollama MCP Server. It stems from the lack of proper validation of a user-supplied string before the string is used in a system call. Remote attackers can exploit it without authentication to execute code in the context of the service account.

vLLM versions from 0.10.1 up to but not including 0.14.0 load Hugging Face `auto_map` dynamic modules during model resolution without checking `trust_remote_code`. An attacker who can influence the model repo or path, whether a local directory or a remote Hugging Face repo, can run arbitrary Python code on the vLLM host at server startup, before any request handling and without API access.

CVE-2025-66960 affects ollama v.0.12.10. A remote attacker can cause a denial of service through the readGGUFV1String function in fs/ggml/gguf.go, which reads a string length from untrusted GGUF metadata. The source classifies the weakness as CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption, and NVD has not yet provided an assessment.

CVE-2025-66959 describes an issue in ollama v.0.12.10 that lets a remote attacker cause a denial of service through the GGUF decoder. The source links a GitHub issue (ollama/ollama issue 9820) and a third-party advisory that attributes the flaw to an unchecked length in the GGUF decoder copy, causing a panic. The CWE entries listed are CWE-20 (Improper Input Validation) and CWE-400 (Uncontrolled Resource Consumption), and NVD has not yet provided an assessment.

Ollama versions 0.11.5-rc0 through 0.13.5 contain a null pointer dereference in the multi-modal image processing code. Malformed base64 image data sent to the /api/chat endpoint makes mtmd_helper_bitmap_init_from_buf return NULL, which is dereferenced without a check, causing a segmentation fault that crashes the runner process. A remote attacker can cause a denial of service, leaving the model unavailable to all users until the service is restarted.