CVE-2026-47479: NVIDIA Triton Inference Server DoS Flaw

CVE-2026-47479 Overview

CVE-2026-47479 affects NVIDIA Triton Inference Server for Linux. The vulnerability allows a remote attacker to trigger uncontrolled resource consumption on the target system. Successful exploitation can lead to denial of service by exhausting server resources.

The flaw is categorized as [CWE-400] Uncontrolled Resource Consumption. The attack requires no authentication, no user interaction, and can be executed over the network against exposed inference endpoints. Organizations running Triton for machine learning model serving are at risk of service disruption.

Critical Impact
A remote, unauthenticated attacker can exhaust server resources on NVIDIA Triton Inference Server for Linux, leading to denial of service and disruption of ML inference workloads.

Affected Products

NVIDIA Triton Inference Server for Linux

Discovery Timeline

2026-07-14 - CVE-2026-47479 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47479

Vulnerability Analysis

NVIDIA Triton Inference Server is an open-source platform for serving machine learning models at scale. It exposes HTTP and gRPC endpoints that accept inference requests from clients.

CVE-2026-47479 stems from an uncontrolled resource consumption condition [CWE-400] in the server. An attacker sending crafted requests over the network can force the server to allocate excessive resources without bounds. This exhausts memory, CPU, or other finite system resources on the host.

The network-accessible nature of Triton amplifies the risk. Inference servers are commonly deployed behind API gateways or exposed directly to internal microservices. A single sustained attack can render the inference tier unavailable, disrupting downstream AI-powered applications.

Root Cause

The root cause is insufficient enforcement of resource limits when processing incoming requests. The server fails to constrain the allocation of memory, threads, or processing time triggered by attacker-controlled inputs. Refer to the NVIDIA security bulletin for exact affected components once published.

Attack Vector

Exploitation occurs over the network against exposed Triton endpoints. An unauthenticated attacker submits crafted inference requests that trigger disproportionate resource consumption. Repeated or sustained requests exhaust host resources and cause the server to become unresponsive, resulting in denial of service for legitimate inference traffic.

No verified proof-of-concept code is publicly available at this time. See the CVE.org record for updates.

Detection Methods for CVE-2026-47479

Indicators of Compromise

Sudden spikes in memory or CPU utilization on Triton Inference Server hosts without a corresponding increase in legitimate traffic.
Repeated inference requests from a single source with unusual payload characteristics or abnormal request patterns.
Triton server processes crashing, restarting, or becoming unresponsive to health checks.

Detection Strategies

Monitor Triton server metrics endpoints for anomalous request rates, queue depths, and resource utilization.
Correlate network flow data against Triton HTTP and gRPC listener ports to identify potential abuse patterns.
Alert on OOM killer events or process termination signals affecting tritonserver on Linux hosts.

Monitoring Recommendations

Enable Prometheus metrics exported by Triton and set thresholds for inference latency and pending request counts.
Log all inbound requests at the ingress or reverse proxy layer for forensic analysis.
Continuously baseline normal inference workload profiles to detect deviation quickly.

How to Mitigate CVE-2026-47479

Immediate Actions Required

Review the NVIDIA security advisory and apply vendor-supplied patches to affected Triton Inference Server deployments.
Restrict network exposure of Triton HTTP and gRPC endpoints to trusted client networks only.
Enforce authentication and rate limiting at an API gateway or reverse proxy in front of Triton.

Patch Information

Consult the official NVIDIA product security page and the NVD entry for CVE-2026-47479 for the fixed version and upgrade instructions. Apply the vendor patch as soon as it becomes available in your change window.

Workarounds

Place Triton behind a rate-limiting reverse proxy such as NGINX or Envoy to cap request volume per client.
Apply container resource limits (--memory, --cpus) to constrain the blast radius of resource exhaustion.
Isolate Triton workloads on dedicated nodes so that denial of service does not affect co-located services.

bash

# Configuration example: constrain Triton container resources and limit exposure
docker run --rm \
  --memory=16g --cpus=8 \
  --network=internal-inference \
  -p 127.0.0.1:8000:8000 \
  -p 127.0.0.1:8001:8001 \
  nvcr.io/nvidia/tritonserver:<patched-version> \
  tritonserver --model-repository=/models \
    --http-thread-count=16 \
    --grpc-infer-allocation-pool-size=16