CVE-2026-24146: NVIDIA Triton Inference Server DoS Flaw

CVE-2026-24146 Overview

NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation combined with a large number of outputs could cause a server crash. This vulnerability allows remote attackers to trigger a denial of service condition by exploiting improper input validation mechanisms in the inference server's output handling routines. A successful exploit of this vulnerability might lead to denial of service, disrupting AI/ML inference workloads and potentially causing significant operational impact for organizations relying on Triton for production machine learning services.

Critical Impact

Remote attackers can crash NVIDIA Triton Inference Server instances without authentication, causing denial of service for AI/ML inference workloads.

Affected Products

• NVIDIA Triton Inference Server

Discovery Timeline

• 2026-04-07 - CVE-2026-24146 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-24146

Vulnerability Analysis

This vulnerability is classified under CWE-789 (Memory Allocation with Excessive Size Value), indicating the server fails to properly validate and constrain the number of outputs requested in an inference operation. When an attacker submits a request with an excessively large number of outputs, the server attempts to allocate resources without adequate bounds checking, leading to resource exhaustion and subsequent server crash.

The vulnerability is exploitable remotely over the network without requiring any authentication or user interaction. This makes it particularly dangerous in environments where Triton Inference Server is exposed to untrusted networks or shared multi-tenant deployments. The attack does not impact data confidentiality or integrity, but it severely affects availability.

Root Cause

The root cause is insufficient input validation when processing inference requests that specify output configurations. The Triton Inference Server does not adequately limit or validate the number of outputs specified in client requests before attempting to allocate memory and processing resources. This oversight allows maliciously crafted requests to trigger excessive memory allocation attempts, leading to server instability and crashes.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted inference requests to an exposed Triton Inference Server instance. The attack involves:

1. Identifying an accessible Triton Inference Server endpoint (typically on HTTP/gRPC ports)
2. Crafting an inference request with an abnormally large number of specified outputs
3. Submitting the malicious request to the server
4. The server attempts to process the excessive output configuration, leading to resource exhaustion and crash

The attack requires network access to the Triton Inference Server but does not require authentication, making it accessible to any attacker who can reach the service endpoint. For technical details on the vulnerability mechanism, refer to the NVIDIA Security Advisory.

Detection Methods for CVE-2026-24146

Indicators of Compromise

• Unexpected Triton Inference Server process crashes or restarts
• Abnormal memory allocation patterns or spikes in server resource utilization
• Inference requests with unusually high output count specifications in server logs
• Repeated connection attempts followed by service unavailability

Detection Strategies

• Monitor Triton Inference Server logs for requests with excessive output parameters
• Implement network-level monitoring for anomalous gRPC or HTTP traffic patterns to inference endpoints
• Deploy application performance monitoring to detect sudden resource exhaustion events
• Configure alerting for Triton server process crashes or automatic restart events

Monitoring Recommendations

• Enable detailed request logging on Triton Inference Server to capture inference request parameters
• Monitor system memory utilization trends for inference server processes
• Set up health check probes to detect service availability degradation
• Implement rate limiting and request validation at the network edge or load balancer level

How to Mitigate CVE-2026-24146

Immediate Actions Required

• Apply the latest security patches from NVIDIA for Triton Inference Server
• Restrict network access to Triton Inference Server endpoints to trusted clients only
• Implement request validation at the application gateway or reverse proxy level
• Enable resource limits and containerization constraints for Triton deployments

Patch Information

NVIDIA has released a security update addressing this vulnerability. Administrators should consult the NVIDIA Security Advisory for specific patch information and upgrade instructions. Organizations should prioritize patching production Triton Inference Server deployments, especially those exposed to external networks.

Workarounds

• Deploy Triton Inference Server behind a reverse proxy or API gateway with request validation capabilities
• Implement network segmentation to limit access to inference server endpoints
• Configure resource limits (memory, CPU) using container orchestration tools to prevent complete system crashes
• Enable request rate limiting to slow down potential denial of service attempts

# Example: Configure resource limits for Triton container deployment
docker run --memory="8g" --memory-swap="8g" \
  --cpus="4" \
  -p 8000:8000 -p 8001:8001 -p 8002:8002 \
  nvcr.io/nvidia/tritonserver:latest