AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| HIGH | CVE-2026-16118 | xdgmime: heap overflow in magic file parsing | rhaiis/vllm-cuda-rhel9 | 7.1 |
| MEDIUM | CVE-2026-58011 | GLib: out-of-bounds read in g_date_time_get_ymd | rhaiis/vllm-cuda-rhel9 | 6.5 |
| HIGH | CVE-2026-58014 | GLib: off-by-one in key file parser enables DoS | rhaiis/vllm-cuda-rhel9 | 7.3 |
| MEDIUM | CVE-2026-58015 | GLib: D-Bus cookie path traversal leaks local files | rhaiis/vllm-cuda-rhel9 | 5.9 |
| LOW | CVE-2025-6170 | libxml2: xmllint shell stack overflow causes local crash | rhaiis/vllm-cuda-rhel9 | 2.5 |
| HIGH | GHSA-cjcg-cxmh-9wcr | Praxis: HTTP/2 HPACK bomb enables memory-exhaustion DoS | praxis-proxy | 7.5 |
| MEDIUM | CVE-2026-105758 | vLLM: unbounded video frame decoding enables DoS | vllm | 5.3 |
| MEDIUM | CVE-2026-105760 | vLLM: unbounded video frame options enable DoS | vllm | 5.3 |
| MEDIUM | CVE-2026-105754 | vLLM: input validation flaws let attacker crash EngineCore | vllm | 6.5 |
| MEDIUM | CVE-2026-105757 | vLLM: unhandled structured-output errors crash engine (DoS) | vllm | 6.5 |
| MEDIUM | CVE-2026-105755 | vLLM: request-ID cache key collision corrupts rerank scores | vllm | 4.2 |
| MEDIUM | CVE-2026-105756 | vLLM: unvalidated cache_salt crashes EngineCore (DoS) | vllm | 6.5 |
| LOW | CVE-2026-105752 | vLLM: cache_salt dropped on tool continuations leaks prefixes | vllm | 3.1 |
| MEDIUM | CVE-2026-105753 | vLLM: reachable assertion in cache causes DoS | vllm | 6.5 |
| HIGH | CVE-2026-105759 | vLLM: unbounded metrics labels allow memory-exhaustion DoS | vllm | 7.5 |
| MEDIUM | CVE-2026-105775 | vLLM: OOB read in Mamba2 mixer enables remote DoS | vLLM | 4.3 |
| MEDIUM | CVE-2026-105922 | vLLM: penalty handler flaw allows remote DoS | vllm | 4.3 |
| UNKNOWN | CVE-2026-103663 | Ollama: path traversal in /api/pull enables root RCE | ollama | - |
| HIGH | GHSA-6gcq-wc29-5xf2 | Coraza WAF: stack overflow DoS via JSON body | github.com/corazawaf/coraza/v3 | 7.5 |
| UNKNOWN | CVE-2022-23957 | HP BIOS: firmware flaw allows denial of service | HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC | - |