CVE-2026-47470: NVIDIA TensorRT-LLM DoS Vulnerability

CVE-2026-47470 Overview

CVE-2026-47470 is an input validation vulnerability [CWE-20] in the NVIDIA TensorRT-LLM gRPC server chat API endpoint. A local attacker can send crafted input to the chat API endpoint to trigger the flaw. Successful exploitation may lead to denial of service, disrupting inference workloads served by the affected TensorRT-LLM deployment.

The issue affects TensorRT-LLM on any supported platform. Because the attack vector is local and requires no privileges or user interaction, environments that expose the gRPC endpoint to shared users or co-tenant workloads face the highest exposure risk.

Critical Impact
A local attacker can crash or disrupt TensorRT-LLM inference services through malformed requests to the gRPC chat API, causing availability loss for hosted LLM workloads.

Affected Products

NVIDIA TensorRT-LLM (all supported platforms)
Deployments exposing the TensorRT-LLM gRPC server chat API endpoint
LLM inference services built on affected TensorRT-LLM versions

Discovery Timeline

2026-07-14 - CVE-2026-47470 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47470

Vulnerability Analysis

The vulnerability resides in the gRPC server chat API endpoint of NVIDIA TensorRT-LLM. The endpoint fails to properly validate inbound request data before processing, allowing malformed input to reach code paths that cannot safely handle it. This results in a service-level failure that impacts availability of the inference server.

Because TensorRT-LLM is commonly used to serve production large language model (LLM) workloads, a triggered fault can interrupt downstream applications relying on chat completion responses. The condition affects confidentiality and integrity in no way, but availability impact is high according to the published vector.

Root Cause

The root cause is improper input validation [CWE-20] in request handling logic within the gRPC chat API. The endpoint accepts fields whose values are not sufficiently constrained or sanitized before being passed to downstream inference and serialization routines. Malformed values traverse the request path and cause the server process to enter an unrecoverable error state.

Attack Vector

Exploitation requires local access to the host running the TensorRT-LLM gRPC server. No authentication or user interaction is required. An attacker with the ability to connect to the local gRPC socket sends a crafted chat request that triggers the input validation failure. The affected service becomes unresponsive or terminates, denying service to legitimate consumers of the inference API.

Refer to the NIST CVE-2026-47470 Details and the CVE.org CVE-2026-47470 Record for the authoritative technical description.

Detection Methods for CVE-2026-47470

Indicators of Compromise

Unexpected termination or repeated restarts of the TensorRT-LLM gRPC server process
Spikes in gRPC error responses (UNAVAILABLE, INTERNAL) from the chat API endpoint
Local process activity connecting to the TensorRT-LLM gRPC listener from unexpected user contexts

Detection Strategies

Monitor TensorRT-LLM server logs for parser errors, exceptions, or abnormal request payloads targeting the chat API
Baseline normal gRPC request patterns and alert on anomalous request structures or sudden availability drops
Correlate local process telemetry with gRPC service crashes to identify the originating client

Monitoring Recommendations

Enable structured logging on the TensorRT-LLM gRPC server and forward logs to a centralized analytics platform
Track service uptime and health-check metrics for inference endpoints and alert on unplanned restarts
Audit local users and processes with access to the gRPC socket to identify unauthorized clients

How to Mitigate CVE-2026-47470

Immediate Actions Required

Restrict local access to the TensorRT-LLM gRPC server socket to trusted service accounts only
Isolate TensorRT-LLM inference hosts from multi-tenant or shared-user environments where feasible
Enable service auto-restart and health monitoring to reduce downtime from availability incidents

Patch Information

Consult the NIST CVE-2026-47470 Details and NVIDIA security bulletins for the fixed TensorRT-LLM version. Apply the vendor-supplied patched release to the inference server binaries and restart the gRPC service. Verify the deployed version after upgrade using the TensorRT-LLM version command supplied by NVIDIA.

Workarounds

Disable or firewall the gRPC chat API endpoint if it is not required by production workloads
Enforce least-privilege access controls on the host running TensorRT-LLM to limit which local users can reach the gRPC socket
Deploy a request-validating proxy in front of the TensorRT-LLM gRPC server to reject malformed chat payloads before they reach the vulnerable endpoint

bash

# Configuration example: restrict local access to the TensorRT-LLM gRPC socket
# Bind the gRPC server to loopback only and restrict socket permissions
chown trtllm:trtllm /var/run/trtllm.sock
chmod 600 /var/run/trtllm.sock

# Verify only the intended service account can access the endpoint
ss -xl | grep trtllm.sock