CVE-2026-47482: NVIDIA Triton Inference Server DoS Flaw

CVE-2026-47482 Overview

CVE-2026-47482 affects NVIDIA Triton Inference Server for Linux. The flaw is a missing release of memory after effective lifetime [CWE-401]. An unauthenticated remote attacker can trigger the condition over the network without user interaction. Successful exploitation exhausts server memory and leads to denial of service against inference workloads.

Triton Inference Server is widely deployed to serve machine learning models in production. A sustained memory leak can degrade availability for downstream applications that depend on model inference. The vulnerability requires no privileges, making exposed instances attractive targets for opportunistic disruption.

Critical Impact
Remote, unauthenticated attackers can exhaust memory on Triton Inference Server hosts, causing denial of service and disrupting AI model serving pipelines.

Affected Products

NVIDIA Triton Inference Server for Linux

Discovery Timeline

2026-07-14 - CVE-2026-47482 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47482

Vulnerability Analysis

The vulnerability is classified under [CWE-401]: Missing Release of Memory after Effective Lifetime. Triton Inference Server fails to free memory allocated during request handling once the allocation is no longer needed. Each triggering request adds to a growing pool of unreclaimed memory. Over time, the process consumes all available memory on the host.

The attack vector is network-based with low complexity and no authentication requirement. Impact is limited to availability, with no confidentiality or integrity effects. The NVD-published EPSS probability is approximately 0.28%.

Root Cause

The root cause is an allocation path within the Triton Inference Server request lifecycle that does not release memory in all execution paths. When specific request patterns reach the vulnerable code, the allocated buffers remain resident after the request completes. Repeated invocation causes the resident set size of the server process to grow until the operating system terminates it or refuses further allocations.

Attack Vector

An attacker sends crafted inference requests to an exposed Triton endpoint over HTTP or gRPC. Each request triggers the leaking allocation. Because no authentication is required, any network-reachable Triton instance is exposed. Sustained request volume converts the leak into a denial of service against the inference service and any co-located workloads.

No verified public exploit code is available for CVE-2026-47482. Technical details are limited to the vendor description referenced in the NVD entry for CVE-2026-47482 and the CVE.org Record for CVE-2026-47482.

Detection Methods for CVE-2026-47482

Indicators of Compromise

Continuously increasing resident set size (RSS) for the tritonserver process without corresponding increase in concurrent request load.
Out-of-memory (OOM) kills recorded in kernel logs targeting the Triton process.
Elevated volumes of inference requests from single or low-diversity source IP addresses.
HTTP 503 or gRPC UNAVAILABLE responses correlated with rising memory usage.

Detection Strategies

Baseline normal memory consumption for the Triton process and alert on deviations sustained beyond a defined threshold.
Correlate request rate metrics with process memory growth to distinguish legitimate load from leak-driven exhaustion.
Inspect Triton access logs for repetitive request patterns targeting the same model endpoint from untrusted sources.

Monitoring Recommendations

Export Triton Prometheus metrics such as nv_inference_request_success and process memory statistics to a central monitoring system.
Enable cgroup memory accounting and container OOM alerts for Triton workloads running in Kubernetes.
Monitor ingress traffic to inference endpoints for anomalous request bursts from external networks.

How to Mitigate CVE-2026-47482

Immediate Actions Required

Restrict network exposure of Triton Inference Server endpoints to trusted client networks only.
Place Triton behind an authenticating reverse proxy or API gateway that enforces rate limits.
Configure container memory limits so a leaking instance is restarted before impacting the host.
Track the NVIDIA CVE-2026-47482 record for the vendor-published fixed version.

Patch Information

Apply the fixed release from NVIDIA once published. Refer to the NVD entry for CVE-2026-47482 for authoritative version guidance. Rebuild container images that embed Triton to consume the patched binary and redeploy across all inference clusters.

Workarounds

Deploy Triton behind an authenticated proxy and require mutual TLS for client connections.
Enforce request rate limiting and per-client quotas at the ingress layer to slow leak accumulation.
Schedule periodic restarts of Triton pods to reclaim leaked memory until a patch is applied.
Segment inference infrastructure so a single failing Triton instance does not cascade to shared services.

bash

# Example Kubernetes resource limits to contain leak-driven OOM
resources:
  limits:
    memory: "8Gi"
  requests:
    memory: "4Gi"
livenessProbe:
  httpGet:
    path: /v2/health/live
    port: 8000
  periodSeconds: 30
  failureThreshold: 3