CVE-2026-47628 in Triton Inference Server
Summary
by MITRE • 08/18/2026
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
The NVIDIA Triton Inference Server, a widely adopted open-source inference serving software designed for high-performance deployment of machine learning models on various hardware accelerators including GPUs and CPUs, contains a critical resource management flaw that exposes infrastructure to availability risks. This vulnerability specifically pertains to the server's handling of incoming requests where it fails to enforce strict limits on resource allocation during the processing pipeline. In production environments, Triton serves as the backbone for real-time AI applications, making its stability paramount; however, this specific weakness allows an adversary to trigger unbounded memory or computational resource consumption by submitting crafted inputs that exploit gaps in input validation and quota enforcement mechanisms within the server's request handling logic.
From a technical perspective, the core of this vulnerability lies in the absence of effective rate limiting or payload size constraints for certain API endpoints or model inference calls. When an attacker sends requests with excessively large payloads or triggers complex computational paths without corresponding checks against system thresholds, the Triton Inference Server allocates memory and processing power proportional to the input magnitude rather than adhering to predefined operational limits. This lack of bounded allocation means that a single malicious request can consume significant portions of available RAM or GPU memory, potentially exhausting all resources allocated to the inference service process. The flaw is particularly dangerous because it does not require authentication in many default configurations, allowing unauthenticated actors on the network to interact with the server and trigger this behavior remotely.
The operational impact of exploiting this vulnerability centers primarily on denial of service conditions that can severely disrupt business continuity for organizations relying on AI-driven services. By exhausting system resources, an attacker can cause the Triton Inference Server process to crash or become unresponsive, leading to a complete halt in model inference capabilities. This results in downtime for downstream applications such as recommendation engines, fraud detection systems, computer vision pipelines, and natural language processing tools that depend on real-time responses from the server. The resulting service interruption can lead to significant financial losses, reputational damage, and operational bottlenecks, especially if the affected system is part of a larger microservices architecture where cascading failures might occur due to dependency timeouts or circuit breaker activations triggered by the unresponsive inference endpoint.
This vulnerability aligns with CWE-787: Out-of-bounds Allocation in terms of resource exhaustion principles, and more specifically maps to CWE-400: Uncontrolled Resource Consumption within the Common Weakness Enumeration framework. In the context of the MITRE ATT&CK matrix for Enterprise, this behavior corresponds to T1496: Resource Hijacking or potentially T1499: Endpoint Denial of Service depending on whether the attacker aims to monopolize resources for other purposes like cryptomining or simply intends to disrupt service availability. The attack vector is typically classified as Network-based with Low complexity, allowing remote exploitation without prior access if the server port is exposed to untrusted networks.
To mitigate this risk, organizations should immediately implement network-level controls such as firewalls and intrusion prevention systems that restrict access to the Triton Inference Server ports from only trusted IP addresses or internal subnets. Enabling authentication mechanisms provided by NVIDIA or integrating with identity providers can add an essential layer of defense against unauthenticated exploitation. Furthermore, administrators must configure resource limits within the Triton configuration files, setting explicit constraints on maximum batch sizes, model concurrency levels, and memory usage thresholds to prevent any single request from overwhelming system resources. Deploying reverse proxies like NGINX or Apache with rate limiting capabilities in front of the inference server can also help absorb malicious traffic spikes before they reach the core service. Regularly updating to the latest version of NVIDIA Triton Inference Server is critical, as vendors frequently release patches that address these resource management gaps and harden the application against such abuse patterns.