EUVD-2026-44469
GHSA-7f2c-g8wp-6p7v
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OpenAI-compatible API is network-exposed by design, warranting AV:N over the official AV:L; no authentication required to submit inference requests; impact is availability-only with no scope change.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in the sampler thread. A successful exploit of this vulnerability might lead to denial of service.
AnalysisAI
Denial of service in NVIDIA TensorRT-LLM (versions through v1.3.0 rc15) allows an attacker who can submit requests to the OpenAI-compatible inference API to trigger a reachable assertion in the sampler thread, crashing the inference service. The impact is limited strictly to availability - no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS sits at 0.12% (2nd percentile), and CISA SSVC rates exploitation status as none, placing this at low operational priority for most teams.
Technical ContextAI
NVIDIA TensorRT-LLM is an open-source library for accelerating large language model inference on NVIDIA GPUs, providing an OpenAI-compatible REST API so clients can use the standard chat/completions interface. The vulnerability is classified as CWE-617 (Reachable Assertion): a defensive assertion in the sampler thread - the component that performs token sampling during autoregressive generation - can be reached via attacker-controlled API input and, when triggered, causes abnormal program termination rather than graceful error handling. The affected product is identified by CPE cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*, covering the full version range up to and including v1.3.0 rc15 per ENISA EUVD-2026-44469. CWE-617 root causes typically arise when assertion macros are left active in production builds and when insufficient input validation allows malformed parameters to propagate into internal logic paths.
RemediationAI
Upgrade NVIDIA TensorRT-LLM to a version beyond v1.3.0 rc15, as this release is the last confirmed vulnerable version per ENISA EUVD-2026-44469; the vulnerability was reported by NVIDIA indicating vendor awareness and a fix path, though an exact named fixed release version is not independently confirmed in the provided references. Until patching is applied, restrict access to the OpenAI-compatible inference API to trusted, known clients using network-layer controls such as firewall rules or a reverse proxy with authentication enforcement - the SSVC 'not automatable' rating means reliable exploitation requires targeted access, so perimeter restriction is an effective compensating control. If the service must remain accessible, consider placing it behind an API gateway that validates request structure before forwarding to the TensorRT-LLM backend, reducing the chance of malformed input reaching the sampler thread. Be aware that adding authentication at the proxy layer may break existing client integrations expecting an unauthenticated OpenAI-compatible endpoint.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today