The vulnerability allows unauthenticated remote attackers to trigger resource exhaustion by providing Markdown image links that are fetched and fully buffered during input validation in VLM mode. The router performs blocking HTTP GET requests, reads the entire response body into memory, and clones it before decoding. This can saturate network bandwidth, inflate memory usage, and overburden the CPU. Attackers can cause the host to crash or become unusable, even if the request is later rejected for exceeding token limits. The effect is a denial‑of‑service that impacts confidentiality is low but availability high and integrity is not directly affected.

Huggingface’s text‑generation‑inference component, specifically the 3.3.6 release. The default deployment configuration is particularly vulnerable because it lacks authentication and does not impose memory usage limits, making the host susceptible to a crash or sustained denial of service. No other versions or products are listed as affected.

The CVSS score of 7.5 indicates a high‑severity flaw, while the EPSS score of less than 1%% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending a crafted request containing an external image link that the server will attempt to fetch, hence the likely attack vector is an unauthenticated HTTP request with a Markdown payload. No additional conditions are required beyond access to the VLM mode of the inference service.