AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| CRITICAL | CVE-2026-112403 | Pillow: heap overflow via lossless JPEG in thumbnail() | Pillow | - |
| LOW | CVE-2026-114049 | vLLM: stale token mask leaks across requests | vllm | 3.7 |
| HIGH | CVE-2026-114050 | vLLM: forged multimodal UUID crashes inference engine | vllm | 7.5 |
| HIGH | CVE-2026-114051 | vLLM: unauth DoS via min_tokens hangs generation | vllm | 7.5 |
| HIGH | CVE-2026-114052 | vLLM: unauthenticated /tokenize exhausts memory (MOSS-Audio) | vllm | 7.5 |
| HIGH | CVE-2026-114053 | vLLM: RCE via code_revision in /tokenize endpoint | vllm | 8.1 |
| MEDIUM | CVE-2026-114054 | vLLM: cache aliasing leaks cross-request media/KV state | vllm | 6.5 |
| HIGH | CVE-2026-114055 | vLLM: unvalidated mm_processor_kwargs enables remote DoS | vllm | 7.5 |
| MEDIUM | CVE-2026-113743 | tt-metal: path traversal in checkpoint loader | 6.3 | |
| MEDIUM | CVE-2026-115886 | MLflow: unsafe scorer deserialization enables SSRF | mlflow | 6.5 |
| MEDIUM | CVE-2026-79980 | Zephyr RTOS: predictable DHCPv4 xid enables gateway/DNS hijack | 5.6 | |
| HIGH | CVE-2026-116172 | vLLM: gRPC top_n validation flaw crashes EngineCore | vllm | 7.5 |
| HIGH | CVE-2026-116173 | vLLM: gRPC logprob limit bypass crashes EngineCore | vllm | 7.5 |
| HIGH | CVE-2026-116174 | vLLM: gRPC invalid token IDs crash EngineCore (DoS) | vllm | 7.5 |
| MEDIUM | CVE-2026-116175 | vLLM: audio decompression bomb exhausts server memory | vllm | 6.5 |
| HIGH | CVE-2026-116176 | vLLM: SSRF via X-Request-Id leaks NCCL KV-cache data | vllm | 8.2 |
| HIGH | CVE-2026-116177 | vLLM: decompression bomb in Nemotron-VL causes DoS | vllm | 7.5 |
| HIGH | CVE-2026-116178 | vLLM: multimodal metadata DoS crashes inference engine | vllm | 7.5 |
| HIGH | CVE-2026-116179 | vLLM: num_frames override enables memory-exhaustion DoS | vllm | 7.5 |
| HIGH | CVE-2026-116180 | vLLM: uninitialized tensor lets tenant crash engine | vllm | 7.7 |