CVE-2026-0599

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET request, reading the entire response body into memory and cloning it before decoding. This behavior can lead to resource exhaustion, including network bandwidth saturation, memory inflation, and CPU overutilization. The vulnerability is triggered even if the request is later rejected for exceeding token limits. The default deployment configuration, which lacks memory usage limits and authentication, exacerbates the impact, potentially crashing the host machine. The issue is resolved in version 3.3.7.

• CWE-400

• https://github.com/huggingface/text-generation-inference/commit/24ee40d143d8d046039f12f76940a85886cbe152
• https://huntr.com/bounties/1d3f2085-666c-4441-b265-22f6f7d8d9cd

Published

Feb 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0593The WP Go Maps (formerly WP Google Maps) plugin for WordPres…5.3
• CVE-2026-0594The List Site Contributors plugin for WordPress is vulnerabl…6.1
• CVE-2026-0595GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2026-0596A command injection vulnerability exists in mlflow/mlflow wh…7.8
• CVE-2026-0597A flaw has been found in Campcodes Supplier Management Syste…9.8
• CVE-2026-0598A security flaw was identified in the Ansible Lightspeed API…4.2
• CVE-2026-0600Server-Side Request Forgery (SSRF) vulnerability in Sonatype…6.2
• CVE-2026-0601A reflected cross-site scripting vulnerability exists in Nex…5.1
• CVE-2026-0602GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-0603A flaw was found in Hibernate. A remote attacker with low pr…8.3
• CVE-2026-0604The FastDup – Fastest WordPress Migration & Duplicator plugi…6.5
• CVE-2026-0605A security vulnerability has been detected in code-projects …9.8