CVE-2025-23326: Nvidia Triton Inference Server DOS Flaw

CVE-2025-23326 Overview

CVE-2025-23326 is an integer overflow vulnerability in NVIDIA Triton Inference Server affecting both Windows and Linux deployments. A remote attacker can submit a specially crafted input to trigger the overflow without authentication or user interaction. Successful exploitation causes a denial of service against the inference server.

The flaw is tracked under CWE-680, which covers integer overflow conditions that lead to buffer overflow or other unsafe memory operations. NVIDIA has published an advisory and security update for affected versions of Triton Inference Server.

Critical Impact

Unauthenticated attackers can remotely disrupt AI inference workloads by sending crafted input that triggers an integer overflow, halting model serving for production applications.

Affected Products

• NVIDIA Triton Inference Server (Windows builds)
• NVIDIA Triton Inference Server (Linux builds)
• Deployments on Microsoft Windows and Linux kernel hosts

Discovery Timeline

• 2025-08-06 - CVE-2025-23326 published to NVD
• 2025-08-12 - Last updated in NVD database

Technical Details for CVE-2025-23326

Vulnerability Analysis

NVIDIA Triton Inference Server is a high-performance serving platform that hosts machine learning models from frameworks such as TensorFlow, PyTorch, ONNX, and TensorRT. It typically exposes HTTP and gRPC endpoints for inference requests on the network.

The vulnerability stems from improper validation of size or length fields when parsing attacker-controlled input. When the affected code path performs arithmetic on these fields, the result wraps around the integer storage limit. This integer overflow leads to undersized allocations, out-of-bounds access, or other unsafe operations that crash the server process.

Because Triton is designed to serve production inference traffic, an unexpected process termination disrupts every model hosted by the affected instance. Recovery requires process restart and may interrupt downstream applications that depend on real-time inference. The impact is confined to availability, with no confidentiality or integrity loss reported by NVIDIA.

Root Cause

The root cause is a [CWE-680] integer overflow to buffer overflow weakness. Input-derived size values are used in calculations without sufficient range checks, allowing the result to exceed the maximum value of the underlying integer type and wrap to a small or negative value.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker who can reach the Triton HTTP or gRPC inference endpoint sends a crafted request whose dimensions, tensor shapes, or payload lengths trigger the overflow during request parsing or tensor handling. The server process then terminates, producing a denial of service condition.

No public exploit code or proof-of-concept has been published for CVE-2025-23326 at the time of writing. Refer to the NVIDIA Support Answer for vendor-specific exploitation context.

Detection Methods for CVE-2025-23326

Indicators of Compromise

• Unexpected crashes or restarts of the tritonserver process without correlating workload changes
• Repeated inference requests from a single source containing abnormally large tensor dimensions or payload sizes
• HTTP 5xx errors or gRPC UNAVAILABLE responses immediately following anomalous request payloads
• Core dumps or segmentation fault entries in system logs referencing Triton libraries

Detection Strategies

• Monitor Triton server logs for parser errors, abrupt termination signals, and watchdog-triggered restarts
• Inspect inference request metadata for tensor shape values approaching 32-bit or 64-bit integer boundaries
• Correlate network telemetry for unauthenticated clients posting to /v2/models/*/infer endpoints with malformed payloads
• Apply rate-based detections for clients that repeatedly cause server crashes within short intervals

Monitoring Recommendations

• Enable Triton metrics export to Prometheus and alert on inference request failure spikes and process restart counters
• Forward host process events and OS-level crash dumps to a centralized SIEM for correlation
• Track availability of model endpoints with synthetic health probes that detect downtime within seconds
• Audit ingress firewall rules to confirm Triton endpoints are not exposed to untrusted networks

How to Mitigate CVE-2025-23326

Immediate Actions Required

• Apply the patched Triton Inference Server release identified in the NVIDIA security bulletin
• Restrict network access to Triton HTTP and gRPC ports so only authenticated, trusted clients can reach inference endpoints
• Place Triton behind an API gateway or reverse proxy that enforces request size limits and input validation
• Inventory all Triton deployments across Windows and Linux hosts to confirm version coverage

Patch Information

NVIDIA has released updated Triton Inference Server builds that address CVE-2025-23326. Administrators should consult the NVIDIA Support Answer 5687 for the fixed version numbers applicable to their platform and upgrade promptly. Full vulnerability metadata is available in the NIST NVD entry for CVE-2025-23326 and the CVE.org record.

Workarounds

• Enforce maximum request size and tensor dimension limits at an upstream proxy until the patch is deployed
• Run Triton inside a process supervisor that restarts the server automatically on crash to limit downtime
• Require mutual TLS or token authentication on inference endpoints to reduce the unauthenticated attack surface
• Segment Triton hosts onto isolated networks accessible only to approved application tiers

# Example: restrict Triton inference ports to an internal subnet on Linux
sudo iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8001 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8000 -j DROP
sudo iptables -A INPUT -p tcp --dport 8001 -j DROP