CVE-2026-63086

text-generation-inference through 3.3.7 contains a server-side request forgery SSRF vulnerability in the OpenAI-compatible multimodal chat completions endpoint that allows unauthenticated network attackers to coerce the server into issuing arbitrary HTTP GET requests by supplying a crafted imageu...

CVE-2026-63086

The CVE-2026-63086 entry concerns text-generation-inference 3.3.7, with an SSRF flaw in the OpenAI-compatible multimodal chat completions endpoint. The fetch_image function in router/src/validation.rs does not validate addresses (private, loopback, link-local, or cloud metadata). The HTTP client ...

GHSA-29PF-2H5F-8G72 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, nemo, text-generation-inference...

CVE-2026-4372 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, nemo, text-generation-inference...

GHSA-38VQ-G6VR-W8WF vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2026-1260 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET...

GHSA-J7X9-7J54-2V3H Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET...

CVE-2026-0599

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET...

EUVD-2026-5137

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET...

CVE-2026-0599

CVE-2026-0599 concerns huggingface/text-generation-inference version 3.3.6, where unauthenticated attackers can trigger a resource-exhaustion DoS via unbounded external image fetching during input validation in VLM mode. The router scans inputs for Markdown image links and issues a blocking HTTP ...

PT-2026-5654

Name of the Vulnerable Software and Affected Versions huggingface/text-generation-inference version 3.3.6 huggingface/text-generation-inference versions prior to 3.3.7 Description A flaw exists in huggingface/text-generation-inference that allows unauthenticated remote attackers to cause a...

Text Generation Inference 资源管理错误漏洞

Text Generation Inference is a Rust, Python, and gRPC server developed by Hugging Face for text generation inference. Version 3.3.6 of Text Generation Inference contains a resource management vulnerability. This vulnerability stems from the unlimited acquisition of external images during input...

CVE-2025-6051 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-RCV9-QM8P-9P6J vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-6638 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-6921 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-59P9-H35M-WG4G vulnerabilities

Vulnerabilities for packages: text-generation-inference...

CVE-2025-3933 vulnerabilities

Vulnerabilities for packages: text-generation-inference...

GHSA-37MW-44QP-F5JM vulnerabilities

Vulnerabilities for packages: text-generation-inference...