CVE-2026-24271: unthrottled GPU allocation causes

CISO Take

NVIDIA TensorRT-LLM's OpenAI-compatible inference API fails to cap or throttle GPU resource allocation (CWE-770), so a caller can exhaust GPU capacity and take the service down. The CVSS 6.2 score reflects a local attack vector with no privileges or user interaction required, and the impact is limited to availability, with no effect on confidentiality or integrity. The EPSS score of 0.0016 sits in the top 95th percentile, which is a small absolute probability but higher than most CVEs. There is no CISA KEV listing, no public exploit, and no Nuclei template, so near-term mass exploitation looks unlikely. The affected-version list and the vendor fix were not available in the data we reviewed, so check the NVIDIA security bulletin for fixed releases. Until you have patched, keep the inference endpoint off shared or untrusted hosts, and put per-client rate limits and GPU quotas in front of it. Prioritize hosts where multi-tenant or shared GPU capacity serves production workloads.

Sources:NVDEPSSATLAS

What is the risk?

Medium risk. The attack requires no privileges and low complexity, but the vector is local (AV:L), so the attacker needs the ability to reach the API from the host or a locally reachable interface. Impact is availability only. Exploitation likelihood is low in absolute terms (EPSS 0.0016) and there is no public exploit, KEV listing, or scanner template. Risk rises on shared GPU hosts, multi-tenant inference platforms, and any deployment where the OpenAI-compatible server is reachable by untrusted local users or containers. Because GPU capacity is expensive and scarce, even a short outage or resource-exhaustion event can have outsized operational and cost impact.

How does the attack unfold?

Initial Access

The attacker reaches the OpenAI-compatible TensorRT-LLM endpoint from the host or a locally reachable interface.

AML.T0040

Exploitation

The attacker sends requests that trigger GPU resource allocation with no limits or throttling.

AML.T0034.001

Impact

GPU resources are exhausted, the inference service degrades or crashes, and dependent applications lose availability.

AML.T0029

Initial Access

The attacker reaches the OpenAI-compatible TensorRT-LLM endpoint from the host or a locally reachable interface.

AML.T0040

Exploitation

The attacker sends requests that trigger GPU resource allocation with no limits or throttling.

AML.T0034.001

Impact

GPU resources are exhausted, the inference service degrades or crashes, and dependent applications lose availability.

AML.T0029

How severe is it?

CVSS 3.1

6.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 5% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Review the NVIDIA security bulletin for CVE-2026-24271 and upgrade TensorRT-LLM to the fixed release once identified. 2) Bind the OpenAI-compatible server to loopback or an isolated network segment, and restrict access to trusted local users and services. 3) Place an API gateway or reverse proxy in front of the endpoint with per-client rate limits, request size limits, and maximum concurrency. 4) Configure server-side limits on batch size, sequence length, max tokens, and concurrent requests where supported. 5) Apply container or cgroup GPU quotas and isolate tenants onto separate GPUs or MIG partitions. 6) Monitor GPU memory use, queue depth, request latency, and out-of-memory errors, and alert on sudden spikes or process restarts.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0040- AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to unknown risks and maintain system resilience

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-24271?

NVIDIA TensorRT-LLM's OpenAI-compatible inference API fails to cap or throttle GPU resource allocation (CWE-770), so a caller can exhaust GPU capacity and take the service down. The CVSS 6.2 score reflects a local attack vector with no privileges or user interaction required, and the impact is limited to availability, with no effect on confidentiality or integrity. The EPSS score of 0.0016 sits in the top 95th percentile, which is a small absolute probability but higher than most CVEs. There is no CISA KEV listing, no public exploit, and no Nuclei template, so near-term mass exploitation looks unlikely. The affected-version list and the vendor fix were not available in the data we reviewed, so check the NVIDIA security bulletin for fixed releases. Until you have patched, keep the inference endpoint off shared or untrusted hosts, and put per-client rate limits and GPU quotas in front of it. Prioritize hosts where multi-tenant or shared GPU capacity serves production workloads.

Is CVE-2026-24271 actively exploited?

No confirmed active exploitation of CVE-2026-24271 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-24271?

1) Review the NVIDIA security bulletin for CVE-2026-24271 and upgrade TensorRT-LLM to the fixed release once identified. 2) Bind the OpenAI-compatible server to loopback or an isolated network segment, and restrict access to trusted local users and services. 3) Place an API gateway or reverse proxy in front of the endpoint with per-client rate limits, request size limits, and maximum concurrency. 4) Configure server-side limits on batch size, sequence length, max tokens, and concurrent requests where supported. 5) Apply container or cgroup GPU quotas and isolate tenants onto separate GPUs or MIG partitions. 6) Monitor GPU memory use, queue depth, request latency, and out-of-memory errors, and alert on sudden spikes or process restarts.

What systems are affected by CVE-2026-24271?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference endpoints, shared GPU clusters, multi-tenant inference platforms.

What is the CVSS score for CVE-2026-24271?

CVE-2026-24271 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.16%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference endpointsshared GPU clustersmulti-tenant inference platforms

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0040AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling. A successful exploit of this vulnerability might lead to denial of service.

Exploitation Scenario

An attacker with local access to a shared GPU inference host, for example through a compromised co-tenant container or a low-privileged user account, sends a burst of requests to the TensorRT-LLM OpenAI-compatible endpoint. The requests use very large context lengths or high concurrency, and the server allocates GPU resources for each one without limits or throttling. GPU memory is exhausted, legitimate inference requests fail or time out, and the serving process may crash. Applications that depend on the model, such as customer-facing assistants or internal agents, become unavailable until the service is restarted, and the attacker can repeat the attack.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.