CVE-2026-47480: NVIDIA Triton Inference Server DoS Flaw

CVE-2026-47480 Overview

CVE-2026-47480 is a denial-of-service vulnerability affecting NVIDIA Triton Inference Server for Linux. The flaw stems from an uncaught exception [CWE-248] that an unauthenticated attacker can trigger over the network. Successful exploitation causes the inference server to terminate abnormally, disrupting model-serving availability for downstream applications.

Triton Inference Server is widely deployed to host machine learning models in production environments. Because the attack vector is network-based and requires no privileges or user interaction, exposed Triton endpoints face significant availability risk. The vulnerability does not impact confidentiality or integrity of data processed by the server.

Critical Impact
A remote, unauthenticated attacker can crash NVIDIA Triton Inference Server by sending crafted input that triggers an unhandled exception, resulting in denial of service for AI inference workloads.

Affected Products

NVIDIA Triton Inference Server for Linux
Deployments exposing Triton HTTP or gRPC inference endpoints
AI/ML production environments relying on Triton for model serving

Discovery Timeline

2026-07-14 - CVE-2026-47480 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47480

Vulnerability Analysis

The vulnerability is classified under [CWE-248]: Uncaught Exception. Triton Inference Server contains a code path where an exception raised during request processing is not caught by a surrounding handler. When the exception propagates unhandled, the server process terminates, halting all model inference activity.

The attack surface is exposed through Triton's network-facing inference APIs. An attacker only needs the ability to reach the service and submit a request crafted to reach the vulnerable code path. No authentication, elevated privileges, or user interaction is required to trigger the condition.

The impact is limited to availability. Confidentiality and integrity remain intact because the flaw does not permit code execution, data disclosure, or state manipulation. However, service interruption of a shared inference server can cascade into failures across dependent applications and pipelines.

Root Cause

The root cause is missing exception handling around an operation that can raise a runtime error when processing attacker-controlled input. The affected function does not guard the operation with a try/catch block or validate inputs before invocation. When the exception propagates to the top of the request-handling thread, the server terminates.

Attack Vector

An attacker sends a specially crafted request to a reachable Triton Inference Server endpoint. The request contains input fields, tensor shapes, model parameters, or protocol elements that force the server into the unhandled exception path. The server process then aborts, disconnecting active clients and rejecting new inference requests until restart.

Refer to the NVD CVE-2026-47480 Detail and the CVE.org Record for CVE-2026-47480 for authoritative technical references.

Detection Methods for CVE-2026-47480

Indicators of Compromise

Unexpected termination or restart events for the tritonserver process on Linux hosts
Sudden spikes in failed inference requests or HTTP/gRPC connection resets from Triton endpoints
Malformed inference requests containing unusual tensor shapes, oversized payloads, or invalid model parameters
Repeated inference requests from a single source IP immediately preceding server crashes

Detection Strategies

Monitor Triton Inference Server logs for unhandled exception traces and abnormal shutdown messages
Correlate process termination events with inbound network traffic to inference API ports (default 8000/8001/8002)
Alert on health-check failures or readiness probe failures from Kubernetes or container orchestration platforms hosting Triton

Monitoring Recommendations

Enable verbose logging on Triton Inference Server and forward logs to a centralized SIEM for exception pattern analysis
Track request-to-crash ratios and set alerts on anomalous inference request payload sizes or malformed protocol frames
Instrument availability metrics for Triton endpoints and alert on repeated restart cycles indicating exploitation attempts

How to Mitigate CVE-2026-47480

Immediate Actions Required

Restrict network access to Triton Inference Server endpoints using firewall rules, security groups, or service mesh policies to trusted clients only
Place Triton behind an authenticating reverse proxy or API gateway that validates inference request structure before forwarding
Enable automatic process restart via systemd, Kubernetes liveness probes, or container orchestration to minimize downtime after a crash

Patch Information

Consult NVIDIA's security bulletin channels for the fixed version of Triton Inference Server addressing CVE-2026-47480. Upgrade all Linux deployments to the patched release once available. Review the NVD CVE-2026-47480 Detail page for updated vendor references.

Workarounds

Deploy rate limiting on inference endpoints to reduce the ability of a single client to repeatedly trigger the crash condition
Run Triton in a horizontally scaled configuration with multiple replicas behind a load balancer so a single crash does not eliminate service capacity
Implement request validation at the ingress layer to reject malformed tensor payloads and unsupported model parameters before they reach Triton

bash

# Example: restrict Triton HTTP/gRPC ports to trusted CIDR using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8001 -j DROP

# Example: Kubernetes liveness probe for automatic restart on crash
# livenessProbe:
#   httpGet:
#     path: /v2/health/live
#     port: 8000
#   periodSeconds: 10
#   failureThreshold: 3