- High 7.5
CVE-2026-0599
A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET request, reading the entire response body into memory and cloning it before decoding. This behavior can lead to resource exhaustion, including network bandwidth saturation, memory inflation, and CPU overutilization. The vulnerability is triggered even if the request is later rejected for exceeding tok…
Scores
The facts
- Published
- 2 February 2026
- Last changed
- 17 June 2026
- NVD status
- Deferred
- Severity
- High, CVSS 7.5 out of 10 (version 3.0)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- Known exploited
- Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
- EPSS
- 29.9% chance of exploitation activity in the next 30 days (percentile 98).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.