CVE-2026-0599

Hugging Face Text Generation Inference (TGI) 3.3.6 contains an uncontrolled resource consumption flaw (CWE-400) that lets an unauthenticated remote attacker trigger unbounded server-side fetching of external images during input validation in vision-language-model (VLM) mode. When a request contains Markdown image links, the router issues a blocking HTTP GET to each referenced URL, reads the entire response body into memory, and clones it before decoding, with no size limit — and this fetching occurs even if the request is later rejected for exceeding token limits. By pointing to large or numerous resources, an attacker saturates network bandwidth, inflates memory, and drives CPU usage, and in the default deployment (no authentication and no memory usage limits) can crash the host machine; the impact is availability-only, with no confidentiality or integrity loss. Any operator running TGI 3.3.6 with VLM mode enabled is affected, with internet-facing instances lacking authentication at greatest risk. No public proof-of-concept or confirmed in-the-wild exploitation is known, although EPSS assigns a 27.6% probability of exploitation within 30 days.

What to do: Upgrade to TGI 3.3.7, which resolves the unbounded image-fetching behavior. Until patched, place TGI behind authentication, enforce memory limits (e.g., container memory caps), and restrict the router's ability to fetch arbitrary external URLs or run VLM mode without egress controls. Audit deployments — especially internet-facing ones — for TGI 3.3.6 or earlier running with VLM mode enabled.