CVE-2026-24264: NVIDIA Triton Inference Server DoS Flaw

CVE-2026-24264 Overview

CVE-2026-24264 affects NVIDIA Triton Inference Server for Linux. The vulnerability stems from improper handling of highly compressed data, classified as [CWE-409]. A remote attacker can send crafted compressed payloads that force the server to consume excessive resources during decompression. Successful exploitation leads to a denial of service condition on the affected inference server.

The flaw is exploitable over the network without authentication or user interaction. Triton Inference Server is widely deployed for hosting machine learning models in production, making service availability a direct concern for AI-driven applications.

Critical Impact
Remote, unauthenticated attackers can trigger a denial of service against NVIDIA Triton Inference Server by submitting highly compressed data, disrupting inference workloads.

Affected Products

NVIDIA Triton Inference Server for Linux
Inference workloads exposing HTTP or gRPC endpoints to untrusted networks
AI/ML production environments dependent on Triton for model serving

Discovery Timeline

2026-07-01 - CVE-2026-24264 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-24264

Vulnerability Analysis

The vulnerability resides in how Triton Inference Server processes compressed input data. When the server receives a highly compressed payload, decompression expands the data far beyond its transport size. The server does not adequately constrain the decompressed output, allowing memory or CPU consumption to grow uncontrollably.

This pattern is commonly known as a decompression bomb or data amplification attack. The CWE-409 classification identifies improper handling of highly compressed data where the ratio between compressed and decompressed size enables resource exhaustion.

The EPSS score is 0.654% at the 46.7 percentile, indicating a moderate near-term exploitation probability relative to other published CVEs.

Root Cause

The root cause is missing or insufficient validation of decompression output size. The server accepts compressed request bodies and expands them without enforcing hard limits on decompressed length, memory allocation, or processing time. A small compressed payload can therefore yield gigabytes of in-memory data.

Attack Vector

Exploitation occurs over the network against exposed Triton endpoints. The attacker submits a request containing a highly compressed payload to an inference endpoint. During request parsing, Triton attempts to decompress the payload, exhausting available memory or CPU. This causes the process to become unresponsive, crash, or trigger out-of-memory termination, denying service to legitimate users.

No authentication is required, and the attacker does not need any interaction from a user or administrator. Repeated submissions can sustain the denial of service condition. Technical details are referenced in the NVIDIA product security advisory.

Detection Methods for CVE-2026-24264

Indicators of Compromise

Sudden spikes in memory or CPU consumption by Triton Inference Server processes without corresponding legitimate workload growth
Repeated out-of-memory (OOM) events or process restarts on hosts running Triton
Inbound HTTP or gRPC requests with abnormally small compressed bodies followed by extended server processing time
Client complaints about inference API timeouts or 5xx errors coinciding with resource anomalies

Detection Strategies

Inspect request headers for Content-Encoding: gzip, deflate, or similar values on inference endpoints and correlate with payload size and response latency
Alert on Triton process memory or CPU crossing thresholds derived from baseline inference workloads
Enable and review Triton server logs for repeated request failures, timeouts, or decompression-related errors
Correlate network telemetry with host telemetry to identify low-bandwidth clients causing disproportionate server load

Monitoring Recommendations

Instrument Triton hosts with resource metrics collection (memory, CPU, file descriptors) and forward to centralized logging
Monitor container or pod restart counts for Triton workloads in Kubernetes deployments
Track HTTP and gRPC request rates, sizes, and error rates per client source address
Set service-level alerts for inference latency percentiles to detect degradation early

How to Mitigate CVE-2026-24264

Immediate Actions Required

Apply the security update referenced in the NVIDIA product security bulletin as soon as available
Restrict network access to Triton inference endpoints so only trusted clients can reach HTTP and gRPC ports
Deploy a reverse proxy or API gateway in front of Triton to enforce request size limits and rate limiting
Review authentication and authorization posture on inference endpoints and remove unnecessary public exposure

Patch Information

Consult the NVIDIA product security repository entry for advisory 5848 for the fixed release versions and upgrade instructions. Additional metadata is available in the NVD entry for CVE-2026-24264 and the CVE.org record.

Workarounds

Configure the fronting proxy to reject requests exceeding a reasonable maximum body size and to cap decompressed payload size
Disable acceptance of compressed request bodies on inference endpoints where clients do not require it
Apply per-client rate limiting and concurrent connection limits at the network edge
Isolate Triton workloads with cgroup or Kubernetes memory and CPU limits so a single process failure does not affect co-located services

bash

# Configuration example
# Example NGINX limits in front of Triton to reduce decompression bomb impact
client_max_body_size 10m;
limit_req_zone $binary_remote_addr zone=triton:10m rate=20r/s;

server {
    listen 8000;
    location / {
        limit_req zone=triton burst=40 nodelay;
        proxy_pass http://triton_upstream;
        proxy_read_timeout 30s;
    }
}