Executive brief
NVIDIA TensorRT-LLM, a library used to optimize and accelerate large language model performance, contains a security flaw in its chat interface component. A local attacker could exploit this vulnerability to crash the service, leading to a denial of service. This could disrupt AI-powered applications and services relying on this library for real-time processing.
Technical details
A vulnerability exists in the gRPC server chat API endpoint of NVIDIA TensorRT-LLM due to improper input validation (CWE-20). A local attacker can exploit this flaw by sending specially crafted requests to the chat API. A successful exploit results in a denial of service (DoS) condition, impacting the availability of the LLM serving infrastructure. The vulnerability affects versions up to and including v1.3.0 rc14 across all platforms.
Affected products
- NVIDIA TensorRT-LLM up to and including v1.3.0 rc14
Timeline
- 2026-07-14: advisory: Initial disclosure by NVIDIA