Inference infrastructure

NVIDIA Triton Inference Server contains a vulnerability, CVE-2025-33201, classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). An attacker can trigger it by sending extra large payloads. A successful exploit may lead to denial of service.

vLLM versions prior to 0.11.1 contain a critical remote code execution flaw in the Nemotron_Nano_VL_Config config class. When a model config includes an auto_map entry, the class calls get_class_from_dynamic_module(...) and instantiates the returned class, which fetches and runs Python from the referenced remote repository, even when trust_remote_code=False is set in vllm.transformers_utils.config.get_config. An attacker can publish a benign-looking frontend repo whose config.json points to a malicious backend repo, so loading the frontend silently executes the backend's code on the victim host.

vLLM versions 0.10.2 up to but not including 0.11.1 contain a memory corruption flaw in the Completions API endpoint. The endpoint calls torch.load() on user-supplied prompt embeddings without sufficient validation, and PyTorch 2.8.0 disables sparse tensor integrity checks by default, so crafted tensors can trigger an out-of-bounds write during to_dense(). The result is a crash (denial-of-service) and potentially code execution on the server hosting vLLM.

CVE-2025-6242 is a Server-Side Request Forgery (SSRF) flaw in the MediaConnector class of the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on target hosts, letting an attacker make the vLLM server send arbitrary requests to internal network resources. The weakness is classified as CWE-918, and NVD has not yet provided an assessment.

CVE-2025-59425 affects vLLM, an inference and serving engine for large language models, before version 0.11.0rc2. Its API key validation uses a string comparison that takes longer the more characters of the key are correct. Across many attempts, an attacker could use this timing difference to recover the key character by character and bypass authentication on deployments that rely on the built-in validation.

CVE-2025-23329 affects NVIDIA Triton Inference Server for Windows and Linux. An attacker who identifies and accesses the shared memory region used by the Python backend can cause memory corruption, which might lead to denial of service. NVD has not yet provided an assessment, and the weaknesses listed are CWE-787 (Out-of-bounds Write) and CWE-284 (Improper Access Control).

NVIDIA Triton Inference Server for Windows and Linux contains CVE-2025-23328, a vulnerability in which an attacker can cause an out-of-bounds write (CWE-787) through a specially crafted input. A successful exploit might lead to denial of service. NVD had not yet provided an assessment at the time of the record.

NVIDIA Triton Inference Server contains a vulnerability in its DALI backend, caused by improper input validation (CWE-20). According to the source, a successful exploit may lead to code execution. NVD has not yet provided an assessment, and the NVIDIA advisory is linked from the NVD page.

CVE-2025-48956 affects vLLM, an inference and serving engine for large language models, from 0.1.0 to before 0.10.1.1. A single HTTP GET request with an extremely large header, sent to an HTTP endpoint, triggers a Denial of Service that exhausts server memory and can crash the server or make it unresponsive. No authentication is required, so any remote user can exploit it.

CVE-2025-23331 affects NVIDIA Triton Inference Server for Windows and Linux. A user who sends an invalid request can cause a memory allocation with an excessive size value, leading to a segmentation fault. A successful exploit might lead to denial of service.