High · published February 2, 2026
⚡ Unbounded external image fetching could wreak havoc here! An unauthenticated attacker can exploit this vulnerability in huggingface/text-generation-inference version 3.3.6, leading to some serious resource exhaustion. 🔥 Think of this as a restaurant where the chef accepts any order without checking if the ingredients are available. A flood of requests for dishes that don’t exist can overload the kitchen, causing chaos and leaving customers hungry! This vulnerability can lead to network bandwidth saturation, memory inflation, and CPU overutilization, potentially crashing your host machine. An attacker could cause a denial of service simply by sending a crafted image link, resulting in a major outage that affects critical functions.
Think of this as a restaurant where the chef accepts any order without checking if the ingredients are available. A flood of requests for dishes that don’t exist can overload the kitchen, causing chaos and leaving customers hungry! In version 3.3.6, the router in VLM mode scans for Markdown image links and performs a blocking HTTP GET request, exhausting resources even if the request exceeds token limits. This unbounded input handling allows attackers to overwhelm the system without any authentication.
This vulnerability can lead to network bandwidth saturation, memory inflation, and CPU overutilization, potentially crashing your host machine. An attacker could cause a denial of service simply by sending a crafted image link, resulting in a major outage that affects critical functions. Upgrade to version 3.3.7 immediately to close this loophole. Additionally, implement memory usage limits in your deployment configuration to prevent resource exhaustion in the future. Don't forget to monitor traffic for any unusual patterns! This is fixable! Follow these steps and you'll have your system running smoothly again in no time! 🛡️