Inference infrastructure

vLLM versions from 0.10.1 up to but not including 0.14.0 load Hugging Face `auto_map` dynamic modules during model resolution without checking `trust_remote_code`. An attacker who can influence the model repo or path, whether a local directory or a remote Hugging Face repo, can run arbitrary Python code on the vLLM host at server startup, before any request handling and without API access.

CVE-2025-66960 affects ollama v.0.12.10. A remote attacker can cause a denial of service through the readGGUFV1String function in fs/ggml/gguf.go, which reads a string length from untrusted GGUF metadata. The source classifies the weakness as CWE-20 Improper Input Validation and CWE-400 Uncontrolled Resource Consumption, and NVD has not yet provided an assessment.

CVE-2025-66959 describes an issue in ollama v.0.12.10 that lets a remote attacker cause a denial of service through the GGUF decoder. The source links a GitHub issue (ollama/ollama issue 9820) and a third-party advisory that attributes the flaw to an unchecked length in the GGUF decoder copy, causing a panic. The CWE entries listed are CWE-20 (Improper Input Validation) and CWE-400 (Uncontrolled Resource Consumption), and NVD has not yet provided an assessment.

Ollama versions 0.11.5-rc0 through 0.13.5 contain a null pointer dereference in the multi-modal image processing code. Malformed base64 image data sent to the /api/chat endpoint makes mtmd_helper_bitmap_init_from_buf return NULL, which is dereferenced without a check, causing a segmentation fault that crashes the runner process. A remote attacker can cause a denial of service, leaving the model unavailable to all users until the service is restarted.

NVIDIA Triton Inference Server contains a vulnerability, CVE-2025-33201, classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). An attacker can trigger it by sending extra large payloads. A successful exploit may lead to denial of service.

vLLM versions prior to 0.11.1 contain a critical remote code execution flaw in the Nemotron_Nano_VL_Config config class. When a model config includes an auto_map entry, the class calls get_class_from_dynamic_module(...) and instantiates the returned class, which fetches and runs Python from the referenced remote repository, even when trust_remote_code=False is set in vllm.transformers_utils.config.get_config. An attacker can publish a benign-looking frontend repo whose config.json points to a malicious backend repo, so loading the frontend silently executes the backend's code on the victim host.

vLLM versions 0.10.2 up to but not including 0.11.1 contain a memory corruption flaw in the Completions API endpoint. The endpoint calls torch.load() on user-supplied prompt embeddings without sufficient validation, and PyTorch 2.8.0 disables sparse tensor integrity checks by default, so crafted tensors can trigger an out-of-bounds write during to_dense(). The result is a crash (denial-of-service) and potentially code execution on the server hosting vLLM.

CVE-2025-6242 is a Server-Side Request Forgery (SSRF) flaw in the MediaConnector class of the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on target hosts, letting an attacker make the vLLM server send arbitrary requests to internal network resources. The weakness is classified as CWE-918, and NVD has not yet provided an assessment.

CVE-2025-59425 affects vLLM, an inference and serving engine for large language models, before version 0.11.0rc2. Its API key validation uses a string comparison that takes longer the more characters of the key are correct. Across many attempts, an attacker could use this timing difference to recover the key character by character and bypass authentication on deployments that rely on the built-in validation.

CVE-2025-23329 affects NVIDIA Triton Inference Server for Windows and Linux. An attacker who identifies and accesses the shared memory region used by the Python backend can cause memory corruption, which might lead to denial of service. NVD has not yet provided an assessment, and the weaknesses listed are CWE-787 (Out-of-bounds Write) and CWE-284 (Improper Access Control).

NVIDIA Triton Inference Server for Windows and Linux contains CVE-2025-23328, a vulnerability in which an attacker can cause an out-of-bounds write (CWE-787) through a specially crafted input. A successful exploit might lead to denial of service. NVD had not yet provided an assessment at the time of the record.

NVIDIA Triton Inference Server contains a vulnerability in its DALI backend, caused by improper input validation (CWE-20). According to the source, a successful exploit may lead to code execution. NVD has not yet provided an assessment, and the NVIDIA advisory is linked from the NVD page.

CVE-2025-48956 affects vLLM, an inference and serving engine for large language models, from 0.1.0 to before 0.10.1.1. A single HTTP GET request with an extremely large header, sent to an HTTP endpoint, triggers a Denial of Service that exhausts server memory and can crash the server or make it unresponsive. No authentication is required, so any remote user can exploit it.