CVE-2026-16497: NVIDIA Triton Inference Server DOS Flaw

CVE-2026-16497 Overview

CVE-2026-16497 is a denial of service vulnerability in NVIDIA Triton Inference Server for Linux. An unauthenticated remote attacker can trigger excessive iteration in the server, exhausting compute resources and disrupting inference availability. The flaw is classified under CWE-834: Excessive Iteration and is exploitable over the network without user interaction. Successful exploitation degrades or halts model serving for downstream applications that depend on Triton for machine learning inference.

Critical Impact
Remote unauthenticated attackers can render NVIDIA Triton Inference Server unresponsive, disrupting production AI/ML inference workloads on affected Linux deployments.

Affected Products

NVIDIA Triton Inference Server for Linux

Discovery Timeline

2026-09-08 - CVE-2026-16497 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-16497

Vulnerability Analysis

The vulnerability resides in NVIDIA Triton Inference Server, an open-source platform that serves machine learning models over HTTP, gRPC, and shared memory interfaces. According to the NVIDIA advisory, an attacker can trigger a code path that performs excessive iteration, consuming CPU or memory resources until legitimate requests cannot be processed. The flaw impacts availability only. Confidentiality and integrity remain unaffected based on the published CVSS vector.

Because Triton is commonly deployed as a backend for user-facing AI services, a sustained denial of service condition can cascade into outages of dependent applications. The advisory does not indicate that authentication or specific model configurations are required to reach the vulnerable code path.

Root Cause

The root cause is mapped to CWE-834: Excessive Iteration. A loop within the server executes an unbounded or attacker-controlled number of iterations when processing crafted input. Without proper bounds checking on iteration counts derived from untrusted request data, the process consumes disproportionate compute time relative to the size of the request.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted request to an exposed Triton endpoint, triggering the excessive iteration condition. The vulnerability description in the NVIDIA Security Repository does not disclose specific exploit primitives. Refer to the vendor advisory for detailed technical guidance.

Detection Methods for CVE-2026-16497

Indicators of Compromise

Sustained CPU saturation on hosts running the tritonserver process without a corresponding increase in legitimate request volume.
Sharp increase in request latency, timeouts, or dropped connections against Triton HTTP or gRPC endpoints.
Repeated inbound requests from a limited set of source addresses immediately preceding degraded service.

Detection Strategies

Baseline normal request rates, payload sizes, and inference latency for each Triton endpoint, then alert on statistical deviations.
Correlate process-level CPU and memory metrics from the inference host with request logs to identify resource exhaustion tied to specific clients.
Enable verbose access logging on API gateways in front of Triton to capture request patterns targeting model endpoints.

Monitoring Recommendations

Ingest Triton server metrics and host telemetry into a centralized analytics platform for behavioral analysis.
Monitor network flows to Triton ports for anomalous request bursts originating from unexpected internal or external sources.
Track process restarts, out-of-memory events, and container health checks for Triton workloads in Kubernetes environments.

How to Mitigate CVE-2026-16497

Immediate Actions Required

Apply the patched Triton Inference Server release referenced in the NVIDIA Security Repository as soon as it is available in your environment.
Restrict network access to Triton endpoints so that only authenticated internal services can reach the inference API.
Deploy rate limiting and request size limits at the ingress or API gateway layer in front of Triton.

Patch Information

NVIDIA has published guidance for this vulnerability in the NVIDIA product security bulletin 5875. Administrators should consult the vendor advisory for the fixed version numbers and upgrade instructions specific to their Triton deployment. Additional metadata is available in the NIST CVE Detail for CVE-2026-16497 and the CVE.org record.

Workarounds

Place Triton behind a reverse proxy that enforces request timeouts, payload size caps, and per-client rate limits.
Segment inference infrastructure so that Triton is not directly exposed to untrusted networks.
Configure Kubernetes resource quotas and pod restart policies to contain the blast radius if a worker becomes unresponsive.

bash

# Example nginx rate limit and timeout configuration in front of Triton
limit_req_zone $binary_remote_addr zone=triton:10m rate=20r/s;

server {
    listen 8000;
    client_max_body_size 8m;
    proxy_read_timeout 15s;
    proxy_send_timeout 15s;

    location / {
        limit_req zone=triton burst=40 nodelay;
        proxy_pass http://triton_backend;
    }
}