EUVD-2026-44434
GHSA-hhg8-wxrj-m3cf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Triton endpoint
-
DeliverySend repeated inference/API requests
-
ExploitTrigger unreleased memory allocation (CWE-401)
-
ExecutionExhaust host/process memory
-
ImpactOOM crash denies model serving
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires network reachability to a running Triton Inference Server's request interface (HTTP/REST on 8000 or gRPC on 8001 by default) on Linux; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special privileges, and no user interaction are needed against a reachable instance. The primary limiting factor is exposure: Triton has no native authentication, so real-world risk hinges on whether the endpoint is exposed to untrusted networks versus isolated behind segmentation or a proxy. The provided data does not specify a particular model, backend, or configuration flag required to trigger the leak, so it should be treated as reachable through the standard inference request path until NVIDIA's advisory narrows the affected feature or version. |
| Impact | The signals are moderately consistent for a DoS-only issue. CVSS 3.1 base score is 7.5 (High) driven entirely by availability (A:H) with an easy exploitation profile: network vector, low complexity, no privileges, no user interaction. There is no confidentiality or integrity impact, so this cannot be chained into code execution or data theft on its own - it is availability-only. No EPSS score was supplied in the input, KEV status is not listed (not actively exploited per available data), and no POC is referenced, so this reads as a real-but-bounded priority: exposure matters most for Triton instances reachable from untrusted networks. No CVSS/description conflict is present - the network vector aligns with Triton's HTTP/gRPC exposure. Key missing data: no EPSS probability, no specific affected/fixed version, and no vendor advisory URL beyond the NVD/CVE.org record, so precise risk to a given deployment cannot be fully confirmed from the provided sources. |
| Exploit ScenarioDerived | An attacker who can reach the Triton HTTP or gRPC inference endpoint sends a stream of crafted or repeated inference/management requests that each leak a small amount of unreleased memory. Over time the server's memory footprint grows unchecked until Triton is OOM-killed or the host becomes unresponsive, taking the model-serving service offline. No authentication or user interaction is required (PR:N/UI:N), and no public POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Denial of service in NVIDIA Triton Inference Server on Linux allows remote unauthenticated attackers to exhaust host memory by triggering a memory leak (CWE-401, missing release of memory after effective lifetime), degrading or crashing the inference service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H) indicates trivial network-reachable exploitation with no authentication and high availability impact, but no confidentiality or integrity exposure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the provided data, and the CPE version is wildcarded, so consult NVIDIA's official security bulletin (linked from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-47482) for the exact fixed release and update the Triton container image or binary to that version once published. As compensating controls while awaiting or applying the fix: restrict access to the Triton HTTP (default 8000) and gRPC (default 8001) inference endpoints to trusted clients only via network segmentation, firewall rules, or an authenticating reverse proxy, since Triton itself provides no built-in authentication - trade-off is that legitimate remote clients must route through the proxy. Additionally, run Triton inside a container or cgroup with a hard memory limit and automatic restart so a leak-induced OOM restarts the service rather than destabilizing the host - trade-off is transient request loss on restart - and add rate limiting on inference requests to slow leak accumulation, at the cost of reduced peak throughput.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA Triton Inference Server is a production-grade model-serving platform that exposes HTTP/REST and gRPC endpoints to serve machine-learning models (TensorRT, ONNX, PyTorch, TensorFlow, Python backends) at scale, typically on GPU-equipped Linux hosts. The root cause is CWE-401 (Missing Release of Memory After Effective Lifetime): a code path allocates memory - likely per-request or per-inference buffers, metadata, or backend resources - that is never freed, so repeated requests steadily grow the resident set until the process or host runs out of memory. Because Triton's request-handling surface is network-facing and processes attacker-supplied inputs, an unauthenticated caller can drive this leak remotely. The single affected CPE, cpe:2.3:a:nvidia:triton_inference_server:*, is version-wildcarded and does not pin the vulnerable range.
Know when Triton Inference Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-facing unauthenticated inference endpoint (AV:N/PR:N/UI:N) with easy triggering (AC:L); availability-only memory-exhaustion impact (A:H) and no confidentiality or integrity effect.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA Triton Inference Server contains a denial-of-service vulnerability (CVE-2026-47482) enabling unauthenticated remote attackers to crash the inference service by exhausting system memory. Although no public exploit has been identified, the lack of authentication requirements and missing vendor patch create material risk for organizations dependent on Triton for production ML workloads. Immediate containment and defensive measures are required to protect inference availability.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network-layer access controls restricting Triton endpoints to trusted internal systems only; (2) rate limiting and request-size constraints to reduce memory exhaustion opportunity; (3) OS or container-level memory limits to cap resource consumption; (4) continuous monitoring for abnormal memory growth with automated restart triggers; (5) architectural redundancy and failover to maintain inference availability during attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Triton Inference Server
View allAuthentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach
Authentication bypass in NVIDIA Triton Inference Server allows remote unauthenticated attackers to circumvent access con
Integer overflow in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigger
Out-of-bounds read in the DALI backend of NVIDIA Triton Inference Server allows authenticated remote attackers to trigge
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitr
NVIDIA Triton Inference Server for Linux contains a vulnerability in the tracing API, where a user can corrupt system fi
NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an impro
Denial of service in NVIDIA Triton Inference Server for Linux allows remote unauthenticated attackers to exhaust server
Denial of service in NVIDIA Triton Inference Server for Linux (versions through 26.03) allows a remote attacker to crash
Denial of service in NVIDIA Triton Inference Server for Linux exposes AI inference infrastructure to remote disruption t
Unbounded resource allocation in NVIDIA Triton Inference Server for Linux allows remote, unauthenticated attackers to ex
Exploit-DB