AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-57173 | vLLM: unbounded audio decode causes OOM DoS | vllm | 6.5 |
| MEDIUM | CVE-2026-69147 | vLLM: request-selected video backend exhausts GPU memory | vllm | 6.5 |
| HIGH | CVE-2026-92762 | Pelican Panel: missing authz lets low-priv users run commands | 8.8 | |
| HIGH | CVE-2026-92971 | LMDeploy: unauthenticated assertion crash halts inference | lmdeploy | 7.5 |
| HIGH | CVE-2026-92983 | LMDeploy: session leak in DistServe enables DoS via OOM | lmdeploy | 7.5 |
| HIGH | CVE-2026-92925 | Redis: cluster bus OOB read enables DoS and info leak | rhaii/vllm-rocm-rhel9 | 7.1 |
| HIGH | CVE-2026-93436 | vLLM: memory leak in PD disaggregation causes DoS | vllm | 7.5 |
| HIGH | CVE-2026-93592 | vLLM: negative token ID crashes embeddings engine | vllm | 7.5 |
| HIGH | CVE-2026-33625 | LMDeploy: eval() injection via malicious model config | lmdeploy | 8.8 |
| CRITICAL | CVE-2025-66455 | LMDeploy: pickle deserialization RCE in DistServe | lmdeploy | 9.8 |
| HIGH | GHSA-39wr-7q6h-cf68 | lmdeploy: URL parser mismatch enables SSRF bypass | lmdeploy | 7.5 |
| MEDIUM | CVE-2026-93840 | vLLM: token ID validation flaw corrupts cross-request logits | vllm | 5.3 |
| MEDIUM | CVE-2026-93841 | vLLM: OOB write in penalty kernel corrupts requests | vllm | 5.3 |
| MEDIUM | CVE-2026-93989 | vLLM: bad_words OOB index corrupts cross-request logits | vllm | 4.3 |
| MEDIUM | CVE-2026-59816 | Joplin Server: path traversal in transcribe API leaks data | 4.3 | |
| HIGH | CVE-2026-94626 | vLLM: unvalidated tp_size allows memory-exhaustion DoS | vllm | 7.5 |
| HIGH | CVE-2026-94622 | vLLM: NIXL KeyError crashes decode engine remotely | vllm | 7.5 |
| HIGH | CVE-2026-94623 | vLLM: NIXL multi-prompt assertion crash causes DoS | vllm | 7.5 |
| HIGH | CVE-2026-94624 | vLLM: unbounded P2P KV sessions crash EngineCore (DoS) | vllm | 7.5 |
| MEDIUM | CVE-2026-94625 | vLLM: Mooncake placeholder leak enables slow DoS | vllm | 5.3 |