AI Threat AlertInference
Inference servers are the most actively-exploited component of the AI stack because they sit between the model and the public internet and they hold the GPU. The shape of the bugs is mostly web-app classes magnified by the cost of compute: missing auth on /v1 endpoints, SSRF that escapes the sandbox onto the platform's control plane, unsafe deserialization on model-loading paths, and path traversal in artifact-management endpoints. vLLM, Triton, TGI, BentoML, Ray Serve, and Ollama have each shipped multiple high-severity CVEs since 2023; CVE-2024-11041 in vLLM was a notable example combining prompt injection with code execution. Multi-tenant deployments are particularly exposed because a single bug typically crosses tenant boundaries. Defenses: aggressive patching, mandatory auth, network segmentation between inference and control plane, and per-tenant resource quotas to bound abuse.
| Severity | CVE | Headline | Package | CVSS |
|---|---|---|---|---|
| MEDIUM | CVE-2026-116181 | vLLM: invalid stop_token_ids crash engine, GPU OOB write | vllm | 6.5 |
| MEDIUM | CVE-2026-115911 | vLLM: chat template DoS via unbounded Jinja rendering | vllm | 6.5 |
| HIGH | CVE-2026-115912 | vLLM: pickle deserialization RCE via multimodal cache | vllm | 7.5 |
| MEDIUM | CVE-2026-115913 | vLLM: Phi-4 audio attention causes GPU OOM DoS | vllm | 6.5 |
| HIGH | CVE-2026-115915 | vLLM: image decoder abuse enables RCE/DoS | vllm | 8.1 |
| MEDIUM | CVE-2026-115916 | vLLM: off-by-one token ID check crashes engine (DoS) | vllm | 6.5 |
| MEDIUM | CVE-2026-115914 | vLLM: zero-sum OCR image crashes engine (DoS) | vllm | 6.5 |
| LOW | CVE-2026-115917 | vLLM: wildcard CORS lets web pages reach local servers | vllm | 3.4 |
| MEDIUM | CVE-2026-115918 | vLLM: chat template bypass enables DoS via /v1/responses | vllm | 6.5 |
| HIGH | CVE-2026-115924 | Rembg: unauthenticated path traversal leaks files | rembg | 8.6 |
| MEDIUM | CVE-2026-116608 | VideoLLaMA2: unverified model integrity on load | VideoLLaMA2 | 5.4 |
| HIGH | GHSA-g5ff-637f-6q2m | LiteLLM: file read via vertex_ai_credentials alias | litellm | 8.1 |
| CRITICAL | CVE-2026-48705 | MONAI: NaN/inf DICOM input causes DoS and corrupt inference | monai | 9.3 |
| LOW | GHSA-h2v8-394m-p7vv | rustls: Brotli cert decoder allows 1 GiB alloc DoS | rustls | 3.7 |
| MEDIUM | CVE-2025-13327 | uv: ZIP parsing differential allows code execution | rhaiis-preview/vllm-cuda-rhel9 | 6.3 |
| MEDIUM | CVE-2026-114406 | Red Hat CA store: weak eMudhra intermediates enable TLS MITM | rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 | 6.8 |
| CRITICAL | CVE-2026-119706 | LMDeploy: unauthenticated RCE via pickle in /update_weights | lmdeploy | 9.8 |
| HIGH | CVE-2024-7557 | OpenShift AI: model auth bypass via exposed token | rhoai/odh-kf-notebook-controller-rhel8 | 8.8 |
Page 47 of 47