CVE-2026-47628: NVIDIA Triton Server DoS Vulnerability

CVE-2026-47628 Overview

CVE-2026-47628 affects NVIDIA Triton Inference Server on Linux. The vulnerability allows a remote attacker to trigger allocation of resources without enforced limits [CWE-770]. Successful exploitation leads to denial of service against the inference server.

The flaw is reachable over the network without authentication or user interaction. Attackers can exhaust server resources by sending crafted requests to exposed inference endpoints. NVIDIA published details in its product security repository on GitHub.

Critical Impact
A network-based attacker can render NVIDIA Triton Inference Server unresponsive, disrupting AI inference workloads that depend on it.

Affected Products

NVIDIA Triton Inference Server for Linux
Deployments exposing Triton HTTP or gRPC inference endpoints
AI inference stacks embedding vulnerable Triton builds

Discovery Timeline

2026-08-18 - CVE-2026-47628 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-47628

Vulnerability Analysis

The vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling. NVIDIA Triton Inference Server accepts inference requests over the network and allocates memory, threads, or queue slots to service them. The affected build does not adequately cap the resources consumed per request or per client.

An unauthenticated attacker can send crafted requests that force the server to allocate large or unbounded resources. Repeated or amplified requests exhaust available memory, CPU, or worker capacity. The server then stops servicing legitimate inference traffic.

The issue affects availability only. Confidentiality and integrity are not impacted, so the vulnerability cannot be used to read model data, tamper with inference results, or execute code. The impact is scoped to the affected Triton process and any workloads that depend on it.

Root Cause

The root cause is missing enforcement of upper bounds on resource allocation during inference request handling. Input parameters that influence buffer sizes, tensor shapes, batch dimensions, or queued work items are accepted without adequate validation or throttling.

Attack Vector

Exploitation requires network access to a Triton HTTP or gRPC endpoint. No credentials and no user interaction are required. The attacker submits inference or management requests whose parameters cause the server to allocate resources beyond safe operational limits.

No public proof-of-concept, exploit code, or CISA KEV listing is available at time of publication. Refer to the NVIDIA product security advisory for authoritative technical details.

Detection Methods for CVE-2026-47628

Indicators of Compromise

Sudden spikes in Triton process memory or CPU utilization without a corresponding increase in legitimate inference traffic.
Repeated HTTP or gRPC requests to Triton endpoints from a single source, especially with unusually large tensor shapes or batch sizes.
Triton worker threads stalled, request queues filling, or health-check endpoints failing.
Out-of-memory kills or container restarts affecting Triton pods or services.

Detection Strategies

Monitor Triton /v2/health/live and /v2/health/ready endpoints for repeated failure transitions.
Alert on anomalous request rates or payload sizes hitting inference ports (default 8000/HTTP, 8001/gRPC, 8002/metrics).
Correlate Triton Prometheus metrics such as nv_inference_queue_duration_us and memory counters with upstream client behavior.
Baseline normal tensor and batch dimensions per model and flag requests exceeding those parameters.

Monitoring Recommendations

Forward Triton logs and metrics to a centralized analytics platform for cross-source correlation.
Enable network flow logging on subnets hosting inference endpoints to attribute traffic bursts.
Track container restart counts and OOMKilled events in Kubernetes environments running Triton.

How to Mitigate CVE-2026-47628

Immediate Actions Required

Restrict network exposure of Triton HTTP, gRPC, and metrics ports to trusted clients using firewalls, service meshes, or network policies.
Place Triton behind an authenticated API gateway or reverse proxy that enforces request size and rate limits.
Apply the NVIDIA patched Triton release referenced in the NVIDIA product security advisory as soon as available.
Audit deployed Triton versions across managed and unmanaged infrastructure to identify vulnerable instances.

Patch Information

NVIDIA has published the advisory in its product security repository at NVIDIA/product-security 2026/5865. Consult the advisory for the fixed version and upgrade instructions. Additional metadata is available at the NVD entry for CVE-2026-47628 and the CVE.org record.

Workarounds

Enforce per-client rate limiting and maximum request body size at an upstream proxy such as NGINX or Envoy.
Constrain Triton container resources with Kubernetes resources.limits for memory and CPU to bound blast radius.
Limit model configuration parameters (max_batch_size, dynamic batching queue sizes) to conservative values.
Disable unused Triton protocols or endpoints to reduce the reachable attack surface.

bash

# Example Kubernetes resource limits and NetworkPolicy to constrain Triton exposure
apiVersion: v1
kind: Pod
metadata:
  name: triton
spec:
  containers:
    - name: triton
      image: nvcr.io/nvidia/tritonserver:<patched-tag>
      resources:
        limits:
          memory: "8Gi"
          cpu: "4"
        requests:
          memory: "4Gi"
          cpu: "2"
      ports:
        - containerPort: 8000
        - containerPort: 8001
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: triton-restrict-ingress
spec:
  podSelector:
    matchLabels:
      app: triton
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              trusted: "true"
      ports:
        - protocol: TCP
          port: 8000
        - protocol: TCP
          port: 8001