What is the CVSS score of CVE-2026-47478?

CVE-2026-47478 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of NVIDIA Triton Inference Server are affected by CVE-2026-47478?

NVIDIA Triton Inference Server for Linux is vulnerable to a remote denial-of-service attack that can be triggered by any unauthenticated attacker, disrupting AI/ML inference workloads with no patch…

How to fix or mitigate CVE-2026-47478?

Within 24 hours, inventory all NVIDIA Triton Inference Server deployments and restrict network access to trusted clients only via firewall rules or network segmentation. Within 7 days, implement rate limiting and request throttling at the load balancer or proxy layer, isolate Triton instances from untrusted networks, and configure centralized monitoring and alerting for connection anomalies. Within 30 days, establish a vendor advisory monitoring process for Triton patches, document current version inventory, and develop a testing and deployment plan for updates once patches become available.

NVIDIA Triton Inference Server CVE-2026-47478

EUVD-2026-44430 HIGH

Use of Expired File Descriptor (CWE-910)

2026-07-14 nvidia

GHSA-4c5q-2cwp-vx9r

Denial Of Service Triton Inference Server Nvidia

7.5

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated network-reachable endpoint (AV:N/PR:N/UI:N) with low complexity; impact is availability-only DoS (A:H, C:N/I:N) with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:02 vuln.today

CVE Published

Jul 14, 2026 - 19:45 cve.org

HIGH 7.5

DescriptionCVE.org

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerability might lead to denial of service.

Articles & Coverage 1

News 14 New Nvidia Vulnerabilities - 14 High Severity, No POC Available Jul 15, 2026

AnalysisAI

Denial of service in NVIDIA Triton Inference Server for Linux allows a remote, unauthenticated attacker to disrupt availability by triggering use of an expired (stale) file descriptor. The flaw impacts availability only (no data exposure or code execution) and, per CVSS PR:N/UI:N, requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; no EPSS score was provided in the input.

Technical ContextAI

Triton Inference Server is NVIDIA's open-source model-serving platform used to deploy AI/ML inference models (TensorRT, PyTorch, ONNX, TensorFlow, Python backends) over HTTP/REST and gRPC endpoints, typically GPU-accelerated on Linux. The root cause is classified as CWE-910 (Use of Expired File Descriptor), meaning the server continues to reference a file descriptor after it has been closed or otherwise released. Such stale descriptors can point to unrelated resources or none at all, leading to unexpected I/O behavior; in this case the consequence is a service crash or hang rather than information disclosure. The affected CPE is cpe:2.3:a:nvidia:triton_inference_server:*:*:*:*:*:*:*:* with no version boundaries specified, so the exact vulnerable range is not delimited in the provided data.

RemediationAI

No vendor-released patch version was identified in the provided data, so the specific fixed release must be confirmed from NVIDIA's security bulletin (start from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-47478 and NVIDIA's product security portal) and upgraded to the patched Triton build once published. As compensating controls until a confirmed patch is applied: restrict network access to the Triton HTTP (default 8000), gRPC (8001), and metrics (8002) endpoints to trusted inference clients only via firewall or network policy, which prevents untrusted DoS traffic but requires an allowlist of legitimate callers; place the server behind an authenticating reverse proxy or API gateway so anonymous requests cannot reach it, at the cost of added latency and operational complexity; and deploy behind a load balancer with health checks and automatic restart (e.g., Kubernetes liveness probes) so a crashed instance is recycled quickly, which limits downtime but does not stop a repeated attacker. Because the impact is availability-only, monitoring for abnormal request patterns and rate-limiting inbound inference requests further reduces exposure.