CVE-2026-65104: CWE-328 Use of Weak Hash in NVIDIA Megatron-LM

NVIDIA Megatron-LM contains a CWE-328 weakness due to the use of a weak hash function in the cache mechanism for inference requests. This weakness can be exploited by an attacker to cause hash collisions, potentially resulting in data tampering and partial disclosure of information during inference operations. The vulnerability is rated with a CVSS 3.1 score of 7.1 (high severity), with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts confidentiality and integrity with a scope change.

Successful exploitation could allow an attacker to manipulate cached inference data, leading to data tampering and partial leakage of sensitive information. This compromises the confidentiality and integrity of the inference process within NVIDIA Megatron-LM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Users should monitor NVIDIA's advisories for updates and apply any forthcoming patches promptly.