TensorRT-LLM vulnerabilities
13 known vulnerabilities in TensorRT-LLM from NVIDIA. 13 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
TensorRT-LLM: Server-Side Request Forgery
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
- 8.4 High severity
TensorRT-LLM: Inclusion of Functionality from Untrusted Control Sphere
NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information dis
- 7.1 High severity
TensorRT-LLM: Server-Side Request Forgery
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
- 7.4 High severity
TensorRT-LLM: Write-what-where Condition
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
- 7.8 High severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, da
- 7.5 High severity
TensorRT-LLM: Heap-based Buffer Overflow
NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer overflow. A successful exploit of this vulnerability might lead to information disclosure, data tampering, or denial of s
- 8.4 High severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might le
- 7.3 High severity
TensorRT-LLM: Missing Authentication for Critical Functionality
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability migh
- 9.8 Critical severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclo
- 7.5 High severity
TensorRT-LLM: Unchecked Return Value to NULL Pointer Dereference
NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
- 9.8 Critical severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- 9.8 Critical severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclos
- 8.8 High severity
TensorRT-LLM: Deserialization of Untrusted Data
NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by local access to the TRTLLM server. A successful exploit of this vulnerability may lead to code execution, information disclo