CVE-2026-47475: NVIDIA TensorRT-LLM DoS Vulnerability

CVE-2026-47475 Overview

CVE-2026-47475 affects NVIDIA TensorRT-LLM, a library used to accelerate large language model inference on NVIDIA GPUs. The vulnerability resides in the OpenAI-compatible inference API, where a local attacker can trigger a reachable assertion in the sampler thread. Successful exploitation results in denial of service against the inference process.

The issue is tracked as [CWE-617] Reachable Assertion. Exploitation requires local access to the API surface, and no authentication or user interaction is needed. Impact is limited to availability; confidentiality and integrity are not affected.

Critical Impact
A local unauthenticated attacker can crash the TensorRT-LLM inference service by sending crafted requests that trigger an assertion in the sampler thread, disrupting model serving.

Affected Products

NVIDIA TensorRT-LLM (OpenAI-compatible inference API)
Deployments exposing the TensorRT-LLM inference server locally
LLM serving stacks built on TensorRT-LLM sampler components

Discovery Timeline

2026-07-14 - CVE-2026-47475 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47475

Vulnerability Analysis

TensorRT-LLM exposes an OpenAI-compatible HTTP inference API for interacting with hosted models. Request parameters flow into the sampler thread, which selects output tokens based on decoding strategies such as top-k, top-p, and temperature sampling.

The vulnerability allows an attacker to submit a request that reaches an assertion statement inside the sampler thread. When the assertion evaluates as false, the process aborts. Because the sampler thread is central to token generation, the entire inference worker becomes unavailable, and any concurrent requests are dropped.

The EPSS score is 0.12%, reflecting a low observed exploitation probability, though the local attack surface remains a concern for shared inference hosts. Exploitation requires no privileges and no user interaction beyond issuing API calls to the local endpoint.

Root Cause

The root cause is an unhandled input condition that reaches a runtime assertion rather than a graceful error path. Developer assertions are intended to catch invariant violations during testing, but here attacker-controlled input can drive execution into that state at runtime. This maps to [CWE-617] Reachable Assertion.

Attack Vector

The attack vector is local. An attacker with the ability to send requests to the TensorRT-LLM OpenAI-compatible API endpoint crafts inference parameters that violate a sampler invariant. Upon processing, the sampler thread aborts and the inference service crashes, denying service to legitimate users. See the NVD CVE-2026-47475 Detail for authoritative advisory information.

No verified proof-of-concept code is publicly available. The vulnerability mechanism involves supplying request parameters that reach an assertion check within the sampler execution path. Refer to the CVE.org Record for CVE-2026-47475 for reference material.

Detection Methods for CVE-2026-47475

Indicators of Compromise

Unexpected termination or SIGABRT exits of the TensorRT-LLM inference worker process
Assertion failure messages referencing the sampler thread in stderr or container logs
Repeated HTTP 5xx responses from the OpenAI-compatible endpoint following specific request patterns
Loss of GPU worker registration in orchestration layers immediately after inbound API calls

Detection Strategies

Correlate inference server crash events with the preceding client request payloads to identify malformed sampling parameters
Monitor process supervisors (systemd, Kubernetes) for elevated restart counts of TensorRT-LLM pods or services
Baseline normal request parameter ranges for top_k, top_p, temperature, and related sampler fields, and alert on outliers

Monitoring Recommendations

Ingest inference server stdout/stderr into centralized logging and alert on assertion strings
Track availability metrics for the OpenAI-compatible endpoint with synthetic health checks
Enable request-level audit logging that captures source IP, request body hash, and response status

How to Mitigate CVE-2026-47475

Immediate Actions Required

Restrict network access to the TensorRT-LLM OpenAI-compatible API to trusted local clients only
Place an authenticating reverse proxy or API gateway in front of the inference endpoint
Apply request validation to reject sampler parameters outside supported ranges before they reach the backend
Configure automatic process restart and rate limiting to reduce sustained denial of service impact

Patch Information

Consult the NVD CVE-2026-47475 Detail and NVIDIA product security bulletins for the fixed TensorRT-LLM release. Upgrade to the vendor-supplied patched version once available and validate that the sampler thread handles malformed inputs with graceful error responses rather than aborts.

Workarounds

Deploy TensorRT-LLM inference workers behind an input-validating proxy that enforces schema and value bounds on sampling parameters
Isolate inference workloads in dedicated containers or namespaces to limit blast radius when a worker crashes
Enable orchestrator-level auto-restart with backoff to restore service continuity after a crash event
Limit API exposure to authenticated internal service accounts and block untrusted local users from the endpoint

bash

# Configuration example: restrict TensorRT-LLM API to localhost and apply reverse proxy rate limits
# nginx snippet in front of the inference server
location /v1/ {
    limit_req zone=llm_api burst=10 nodelay;
    proxy_pass http://127.0.0.1:8000;
    proxy_set_header X-Request-Id $request_id;
    client_max_body_size 64k;
}