7.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-0599

CVE-2026-0599: Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Markdown image links and performs a blocking HTTP GET request, reading the entire response body into memory and cloning it before decoding. This behavior can lead to resource exhaustion, including network bandwidth saturation, memory inflation, and CPU overutilization. The vulnerability is triggered even if the request is later rejected for exceeding token limits. The default deployment configuration, which lacks memory usage limits and authentication, exacerbates the impact, potentially crashing the host machine. The issue is resolved in version 3.3.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-0599

CVE-2026-0599:

7.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
text-generation	pip	< 3.3.7	3.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an uncontrolled resource consumption issue in the text-generation-inference router. The root cause is in the fetch_image function located in router/src/validation.rs. This function was responsible for downloading images from URLs provided in the user's input. The vulnerable version of the code read the entire response body into memory without enforcing any size limits, using reqwest::blocking::get(url)?.bytes()?. An attacker could exploit this by crafting a request containing a markdown image link pointing to an extremely large file. This would cause the server to attempt to allocate a large amount of memory, leading to memory exhaustion and a denial of service.

The patch addresses this by introducing a size limit (max_image_fetch_size). The updated fetch_image function now first inspects the Content-Length header of the response. If the reported size exceeds the limit, the request is immediately rejected. If the header is not present, it proceeds to read the response body but uses response.take() to enforce a hard limit on the number of bytes read from the socket, thus preventing the application from consuming excessive memory. The prepare_input function was also identified as it is the function that parses the user input and calls the vulnerable fetch_image function.

Vulnerable functions

text_generation_router::validation::fetch_image

router/src/validation.rs

This function is responsible for fetching an image from a given URL. Before the patch, it would download the entire content of the URL into memory without any size limit. This allowed an unauthenticated attacker to provide a URL to a very large file, causing the server to exhaust its memory and crash, leading to a denial of service.

text_generation_router::validation::prepare_input

router/src/validation.rs

This function processes the user-provided input, identifies markdown image links, and then calls the `fetch_image` function to retrieve the image. It is a key component in the vulnerability chain as it handles the malicious input and passes it to the vulnerable download function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.