What is the CVSS score of CVE-2026-24175?

CVE-2026-24175 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nvidia are affected by CVE-2026-24175?

NVIDIA Triton Inference Server versions prior to r26.02 contain a remote denial-of-service vulnerability that allows unauthenticated attackers to crash the inference service by sending malformed HTTP…

How to fix or mitigate CVE-2026-24175?

Within 24 hours: Inventory all Triton Inference Server deployments and document current versions. Within 7 days: Isolate affected servers (versions prior to r26.02) from untrusted networks or disable public-facing HTTP endpoints; implement network-level filtering to detect malformed HTTP headers. Within 30 days: Upgrade all instances to NVIDIA Triton Inference Server r26.02 or later once vendor patch verification is confirmed.

Nvidia CVE-2026-24175

EUVD-2026-19759 HIGH

Uncaught Exception (CWE-248)

2026-04-07 nvidia

Nvidia Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 17:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 18:00 euvd

EUVD-2026-19759

Analysis Generated

Apr 07, 2026 - 18:00 vuln.today

CVE Published

Apr 07, 2026 - 17:13 nvd

HIGH 7.5

DescriptionCVE.org

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header to the server. A successful exploit of this vulnerability might lead to denial of service.

AnalysisAI

Remote denial of service in NVIDIA Triton Inference Server versions prior to r26.02 allows unauthenticated attackers to crash the server by sending malformed HTTP request headers over the network. The vulnerability scores 7.5 (High) with maximum availability impact, requires no authentication or user interaction, and has low attack complexity. EPSS and KEV data not provided; no public exploit identified at time of analysis.

Technical ContextAI

NVIDIA Triton Inference Server is a production-ready AI model serving platform that handles inference requests via HTTP/HTTPS and gRPC protocols. This vulnerability stems from CWE-248 (Uncaught Exception), indicating the server fails to properly validate or handle malformed HTTP request headers, allowing an exception to propagate uncaught and terminate the server process. The affected component appears to be the server's request parsing layer, which should sanitize header input before processing. All versions prior to release r26.02 contain this input validation weakness, affecting the core cpe:2.3:a:nvidia:triton_inference_server platform across all deployment configurations.

RemediationAI

Upgrade NVIDIA Triton Inference Server to version r26.02 or later, which contains vendor-released patches addressing the malformed header parsing vulnerability. Organizations should prioritize patching internet-facing inference endpoints and customer-accessible AI services immediately. For environments where immediate patching is not feasible, implement network-level protections including Web Application Firewall (WAF) rules to filter malformed HTTP headers, rate limiting to mitigate DoS impact, and network segmentation to restrict Triton server exposure to trusted clients only. Consult the official NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5816 for complete remediation guidance, release notes, and deployment-specific considerations. Monitor server logs for unusual request patterns or parsing errors that may indicate exploitation attempts during the patching window.