Read the docs
TI-2026-71773 Aliases CVE-2026-65104GHSA-mf54-g87x-8pg4

Hash collisions in NVIDIA Megatron-LM inference cache

Priority LOW 30CWE-328Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NVIDIA Megatron-LM versions 0 to 17 are affected. The flaw is a weak hash (CWE-328) used by the inference cache, which lets an attacker cause hash collisions in the cache for inference requests. An attacker on the network with low privileges can exploit it with high complexity and no user interaction. A successful exploit may lead to data tampering and partial information disclosure.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and partial information disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NVIDIAMegatron-LM0 to 17—No fix listedCNA
  • Megatron-LM VendorNVIDIA Affected 0 to 17 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nvidia:megatron-lm:*:*:*:*:*:*:*:*——NVIDIA
  • cpe:2.3:a:nvidia:megatron-lm:*:*:*:*:*:*:*:* Versions — — ·NVIDIA

Remediation

The sources list no fixed version for NVIDIA Megatron-LM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-65104
  2. 2026-10-13 Alias added: GHSA-mf54-g87x-8pg4

References

Other 3

  • TI-2017-10594 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a… CVSS 3.1CRITICAL 9.8
  • TI-2025-17134 Time-of-check time-of-use race condition in NVIDIA Container Toolkit CVSS 3.1HIGH 8.3
  • TI-2024-00121 Time-of-check time-of-use race condition in NVIDIA Container Toolkit CVSS 3.1CRITICAL 9.0
  • TI-2024-00076 NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set… CVSS 3.1CRITICAL 9.0
  • TI-2018-02664 Observable discrepancy in Intel Multiple CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
See all 1247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences