CVE-2026-47629: NVIDIA Triton Server DoS Vulnerability

CVE-2026-47629 Overview

CVE-2026-47629 is an improper input validation vulnerability [CWE-20] affecting NVIDIA Triton Inference Server for Linux. An attacker can send crafted input over the network to trigger the flaw, resulting in a denial-of-service condition on the inference server. The vulnerability requires no authentication and no user interaction, making it reachable from any network-adjacent client that can connect to the Triton service. Exploitation impacts availability only; confidentiality and integrity are not affected.

Critical Impact
Unauthenticated network attackers can crash or hang NVIDIA Triton Inference Server instances, disrupting AI/ML inference workloads that depend on the service.

Affected Products

NVIDIA Triton Inference Server for Linux
AI/ML inference workloads deployed on Triton
Containerized Triton deployments exposing HTTP or gRPC endpoints

Discovery Timeline

2026-08-18 - CVE-2026-47629 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-47629

Vulnerability Analysis

CVE-2026-47629 stems from improper input validation within NVIDIA Triton Inference Server for Linux. The server accepts client requests over the network for model inference, and one or more request-handling paths fail to properly validate incoming input before processing it. An unauthenticated remote attacker can send a crafted request that exercises the unvalidated code path, causing the server process to enter an error state and stop serving legitimate inference traffic.

Because Triton is commonly deployed as a central inference endpoint for downstream applications, a successful denial-of-service event cascades into upstream services that rely on model predictions. The vulnerability is classified under CWE-20: Improper Input Validation.

Root Cause

The root cause is missing or insufficient validation of client-supplied input in the Triton request-processing pipeline. When malformed or unexpected input reaches internal handlers without prior sanitization, the server encounters an unrecoverable condition and terminates or hangs the affected worker.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker with reachability to the Triton HTTP or gRPC endpoint sends a specially crafted inference or management request. Attack complexity is low, and no privileges or user interaction are required. See the NVIDIA product security advisory for vendor-supplied technical details.

// No verified public proof-of-concept is available at time of publication.
// Consult the NVIDIA security advisory for technical specifics:
// https://github.com/NVIDIA/product-security/tree/main/2026/5865

Detection Methods for CVE-2026-47629

Indicators of Compromise

Unexpected termination, restart loops, or hangs of the tritonserver process on Linux hosts.
Sudden spikes in malformed HTTP or gRPC requests to Triton endpoints on ports 8000, 8001, or 8002.
Loss of inference response availability while the host itself remains reachable.

Detection Strategies

Monitor Triton server logs for parser errors, assertion failures, or abnormal shutdown messages preceding crashes.
Baseline normal client request payloads and alert on requests with anomalous field sizes, unexpected data types, or malformed protobuf messages.
Correlate network flow telemetry showing repeated short-lived connections from a single source to Triton endpoints.

Monitoring Recommendations

Track tritonserver process uptime and restart counts as a health signal in your metrics platform.
Alert on HTTP 5xx and gRPC UNAVAILABLE response rates exceeding a baseline threshold.
Log and retain full request metadata at the ingress proxy to support post-incident analysis.

How to Mitigate CVE-2026-47629

Immediate Actions Required

Apply the fixed version of NVIDIA Triton Inference Server as documented in the NVIDIA product security advisory.
Restrict network access to Triton HTTP, gRPC, and metrics endpoints so only trusted clients can reach them.
Place Triton behind an authenticated API gateway or reverse proxy that enforces schema validation on inbound requests.

Patch Information

Refer to the NVIDIA product security bulletin for CVE-2026-47629 for the specific fixed versions and upgrade guidance. Additional references are available in the NVD entry for CVE-2026-47629 and the CVE.org record.

Workarounds

Enforce network segmentation so Triton endpoints are not exposed to untrusted networks or the public internet.
Deploy a validating proxy in front of Triton that rejects malformed inference requests before they reach the server.
Configure process supervision (for example, systemd or Kubernetes liveness probes) to restart Triton automatically after a crash while patching is in progress.

bash

# Example: restrict Triton HTTP/gRPC/metrics ports to an internal management CIDR
sudo iptables -A INPUT -p tcp -m multiport --dports 8000,8001,8002 \
  -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp -m multiport --dports 8000,8001,8002 \
  -j DROP