What is the CVSS score of CVE-2026-24174?

CVE-2026-24174 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nvidia are affected by CVE-2026-24174?

NVIDIA Triton Inference Server versions prior to r26.02 contain a remote denial-of-service vulnerability that allows unauthenticated network attackers to crash the inference server through malformed…

How to fix or mitigate CVE-2026-24174?

Within 24 hours: Identify all Triton Inference Server deployments and document current versions; isolate internet-facing instances behind a Web Application Firewall (WAF) with request validation rules. Within 7 days: Implement network-level access controls restricting Triton to trusted clients only; establish continuous monitoring for abnormal request patterns. Within 30 days: Monitor NVIDIA security advisories for patch release of r26.02 or later; conduct staged testing in non-production environments immediately upon patch availability and deploy within 5 business days of vendor release.

Nvidia CVE-2026-24174

EUVD-2026-19757 HIGH

Incorrect Conversion between Numeric Types (CWE-681)

2026-04-07 nvidia

Denial Of Service Nvidia

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 17:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19757

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:12 nvd

HIGH 7.5

DescriptionCVE.org

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Remote denial of service in NVIDIA Triton Inference Server (all versions prior to r26.02) allows unauthenticated attackers to crash the server via malformed requests. The vulnerability has a CVSS score of 7.5 with network-accessible attack vector and low complexity, requiring no privileges or user interaction. EPSS data not provided; no public exploit identified at time of analysis. The issue stems from improper conversion between numeric types (CWE-681), enabling trivial service disruption for ML inference workloads.

Technical ContextAI

NVIDIA Triton Inference Server is an open-source inference serving platform for deploying trained AI models at scale. The vulnerability resides in the server's request parsing logic, classified as CWE-681 (Incorrect Conversion between Numeric Types). This weakness class typically involves integer overflow, truncation, or type confusion when converting between numeric representations (e.g., string-to-integer, float-to-int, signed-to-unsigned). In network-facing services, such conversion errors can cause exceptions, crashes, or undefined behavior when processing untrusted input. The affected component is identified by CPE cpe:2.3:a:nvidia:triton_inference_server, indicating the core server application across all deployment modes (Docker, Kubernetes, bare metal). Given Triton's role in production ML pipelines, a crash vulnerability directly impacts model availability for real-time inference applications.

RemediationAI

Upgrade immediately to NVIDIA Triton Inference Server release r26.02 or later, which addresses the malformed request handling flaw. Download the patched release from NVIDIA's official distribution channels (NGC container registry or GitHub releases). For containerized deployments, update base images and redeploy pods/containers with version tag r26.02+. Verify version post-upgrade using tritonserver --version command. As an interim mitigation for environments unable to patch immediately, implement strict network segmentation to limit Triton server exposure to trusted clients only, deploy web application firewall (WAF) rules to filter malformed requests if signatures become available, and enable comprehensive monitoring/alerting for unexpected server crashes. The official vendor security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5816 provides additional remediation guidance and version-specific instructions. No workaround fully eliminates the vulnerability; patching to r26.02 is the definitive solution.