CVE-2025-33238: NVIDIA Triton Server DoS Vulnerability

CVE-2025-33238 Overview

NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerability may lead to denial of service, potentially disrupting machine learning inference operations that depend on the Triton Inference Server platform.

Critical Impact

This network-accessible vulnerability allows unauthenticated attackers to cause denial of service conditions in NVIDIA Triton Inference Server Sagemaker deployments, impacting availability of ML inference services.

Affected Products

• NVIDIA Triton Inference Server (Sagemaker HTTP server component)

Discovery Timeline

• 2026-03-24 - CVE-2025-33238 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2025-33238

Vulnerability Analysis

This vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), commonly known as a race condition vulnerability. The flaw exists within the Sagemaker HTTP server component of NVIDIA Triton Inference Server, where improper handling of concurrent requests can lead to an unhandled exception.

The vulnerability enables remote attackers to trigger exception conditions without requiring any privileges or user interaction. When successfully exploited, the affected server component may crash or become unresponsive, resulting in a denial of service condition that impacts the availability of machine learning inference workloads.

Root Cause

The root cause of this vulnerability stems from a race condition (CWE-362) in the Sagemaker HTTP server's request handling logic. Race conditions occur when multiple threads or processes access shared resources without proper synchronization mechanisms. In this case, concurrent HTTP requests to the Triton Inference Server can trigger a timing-dependent code path that results in an unhandled exception, causing the service to crash or become unavailable.

Attack Vector

The attack vector for CVE-2025-33238 is network-based, requiring no authentication or user interaction to exploit. An attacker with network access to the vulnerable Triton Inference Server can craft and send specially timed HTTP requests to the Sagemaker endpoint.

The exploitation mechanism involves triggering the race condition by sending concurrent requests that cause the server to enter an inconsistent state. When the timing conditions are met, the server throws an unhandled exception, leading to service disruption. This attack can be repeated to maintain a persistent denial of service condition against the target ML inference infrastructure.

Detection Methods for CVE-2025-33238

Indicators of Compromise

• Unusual patterns of HTTP requests to Triton Inference Server Sagemaker endpoints with high concurrency
• Server crash logs or exception traces indicating race condition failures
• Repeated service restarts or availability interruptions in Triton Inference Server deployments
• Anomalous network traffic patterns targeting ML inference endpoints

Detection Strategies

• Monitor Triton Inference Server logs for unhandled exception events and abnormal termination patterns
• Implement network-level detection for unusual concurrent request patterns to Sagemaker HTTP endpoints
• Configure alerting on service availability metrics for Triton Inference Server instances
• Deploy intrusion detection rules to identify potential denial of service attack patterns

Monitoring Recommendations

• Enable verbose logging on Triton Inference Server instances to capture request timing and exception details
• Set up automated health checks and restart policies for affected deployments
• Monitor system resource utilization (CPU, memory, thread counts) for anomalous patterns
• Implement network traffic analysis to detect potential exploitation attempts

How to Mitigate CVE-2025-33238

Immediate Actions Required

• Review the NVIDIA Support FAQ for official guidance and patches
• Assess exposure of Triton Inference Server Sagemaker endpoints to untrusted networks
• Implement network segmentation to restrict access to ML inference infrastructure
• Enable rate limiting on HTTP endpoints to reduce attack surface

Patch Information

NVIDIA has published security guidance for this vulnerability. Organizations should consult the NVIDIA Support FAQ for official patch information and updated software versions. It is strongly recommended to apply vendor-provided patches as soon as they become available.

For additional technical details, refer to the NVD CVE-2025-33238 Details page.

Workarounds

• Restrict network access to Triton Inference Server endpoints using firewall rules or security groups
• Deploy the server behind a reverse proxy with request rate limiting and connection throttling
• Implement authentication layers in front of exposed Sagemaker HTTP endpoints
• Consider running Triton Inference Server in isolated network segments with strict ingress controls

# Example: Configure network access restrictions for Triton Inference Server
# Restrict access to trusted IP ranges only using iptables
iptables -A INPUT -p tcp --dport 8080 -s <trusted_network_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Alternative: Use security groups in cloud environments to limit exposure
# Consult your cloud provider's documentation for specific configuration