resource-exhaustion
2 live · 21 on record · last incident 1 day ago
Live2
- liveOverServe: Resource amplification attacks on SaaS agents
Research · since 13 Nov 2026
Researchers introduced a multi-agent framework that exploits completion decisions in SaaS agents to extend execution times and waste provider resources. The study demonstrates the attack pattern in a lab environment without real-world incidents.
AI - liveChatter Attack Resource Consumption Technique for Large Language Models
Research · since 10 Nov 2026
Researchers demonstrated Chatter Attack, an attack technique that induces large language models into generating excessively long outputs during inference. The approach significantly drives up computational latency and operational hosting costs.
Do:Implement strict inference timeout thresholds and maximum output token limits to limit exposure to resource consumption attacks.
AI
Earlier19
- closed7.1vLLM CVE-2026-126399: vLLM resource exhaustion vulnerability via video frame limits bypass
Patch now · Disclosed · Patched · since 13 Nov 2026 · CVE-2026-126399
AI - closed8.7vLLM CVE-2026-126397: vLLM quadratic CPU work vulnerability in Cohere2 Vision multimodal preprocessing
Patch now · Disclosed · Patched · since 13 Nov 2026 · CVE-2026-126397
AI - closed6.9vLLM CVE-2026-126396: vLLM resource exhaustion vulnerability in MiniMax M3 VL video processor
Patch now · Disclosed · Patched · since 13 Nov 2026 · CVE-2026-126396
AI - closed6.5vLLM CVE-2026-115918: vLLM chat template parsing resource exhaustion
Patch now · Disclosed · Patched · since 26 Oct 2026 · updated 28 Oct 2026 · CVE-2026-115918
AI - closed8.7vLLM CVE-2026-116177: vLLM uncontrolled resource consumption via decompression bomb
Patch now · Disclosed · since 25 Oct 2026 · CVE-2026-116177
AI - closed7.5MCP SDKs Model Context Protocol Python SDK Unbounded Session Accumulation Flaw
Patch now · Disclosed · since 14 Oct 2026 · updated 15 Oct 2026 · CVE-2026-59951
AI - closed5.3vLLM vLLM GLMGA video sampling permits CPU and memory exhaustion
Patch now · Disclosed · since 5 Oct 2026 · CVE-2026-105760
AI - closed7.5vLLM CVE-2026-105759: vLLM Prometheus Metrics Memory Exhaustion Vulnerability
Patch now · Disclosed · since 5 Oct 2026 · CVE-2026-105759
AI - closed6.9vLLM vLLM Audio Size Enforcement Bypass Permits Resource Exhaustion
Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100648
AI - closed6.3vLLM vLLM Decoder Allocation Resource Limit Bypass Causes GPU Memory Exhaustion
Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100649
AI - closed7.1vLLM CVE-2026-100650: vLLM materializes remote media before size enforcement
Patch now · Disclosed · since 26 Sep 2026 · CVE-2026-100650
AI - closed8.7vLLM CVE-2026-94626: vLLM Memory Exhaustion via Unvalidated tp_size Parameter
Patch now · Disclosed · since 21 Sep 2026 · CVE-2026-94626
AI - closed6.9vLLM CVE-2026-94625: vLLM Resource Exhaustion in MooncakeConnector Transfer Placeholders
Patch now · Disclosed · since 21 Sep 2026 · CVE-2026-94625
AI - closed8.7vLLM vLLM Mooncake connector GPU memory exhaustion vulnerability
Patch now · Disclosed · since 21 Sep 2026 · CVE-2026-94627
AI - closed8.7vLLM CVE-2026-93436: Memory exhaustion vulnerability in vLLM inference server
Patch now · Disclosed · since 17 Sep 2026 · CVE-2026-93436
AI - closed6.2MCP SDKs MCP Kotlin SDK vulnerable to buffer growth denial of service
Patch now · Disclosed · since 9 Sep 2026 · CVE-2026-53937
AI - closed7.5vLLM CVE-2026-37237: vLLM Unbounded Media Fetching Memory Exhaustion
Patch now · Disclosed · since 28 Aug 2026 · CVE-2026-37237
AI - closed6.5vLLM CVE-2026-73559: Denial of service vulnerability in vLLM completion prompt preprocessing
Patch now · Disclosed · since 13 Aug 2026 · CVE-2026-73559
AI - closed7.5Open WebUI CVE-2024-12534: Open WebUI Uncontrolled Resource Consumption Vulnerability
Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-12534
AI