CVE-2026-24264: NVIDIA Triton Inference Server Denial of Service Vulnerability

Technical summary

CVE-2026-24264 is a denial-of-service vulnerability in NVIDIA Triton Inference Server for Linux stemming from improper handling of highly compressed data inputs (CWE-409: Improper Restriction of Rendered UI Layers or Frames). The attack requires only network access with no authentication or user interaction; an unauthenticated remote actor can send malformed compressed payloads that cause the inference server process to fail or hang. The vulnerability is network-accessible and has low attack complexity, as demonstrated by the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N).

Business impact

For enterprises operating Triton Inference Server as part of their AI infrastructure, this vulnerability directly threatens service availability. ML pipeline interruptions can cascade through dependent applications, disrupting real-time inference, batch processing, or downstream analytics. Organizations using Triton in production for computer vision, NLP, or recommendation systems should assess the operational cost of potential downtime and prioritize patching accordingly.

Affected systems

The vulnerability affects NVIDIA Triton Inference Server on Linux systems. Both the Triton application and the underlying Linux kernel version may factor into the overall risk profile, depending on how Triton interacts with OS-level compression handling. Organizations should inventory their Triton deployments—including version numbers, container image tags, and deployment environments (Kubernetes, on-premises, cloud)—to determine exposure scope.

Exploitability

This vulnerability carries moderate exploitability. While it requires no authentication, user interaction, or privilege escalation, the attacker must craft and send specific malformed compressed data, which suggests some technical precision is needed. However, the network-accessible nature and absence of authentication barriers lower the barrier to exploitation. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no confirmed in-the-wild exploitation as of the latest update.

Remediation

Contact NVIDIA for patched versions of Triton Inference Server and verify patch availability against the official NVIDIA security advisories and product documentation. Apply updates in a staged manner—test in non-production environments first to ensure compatibility with your inference pipelines. If immediate patching is not feasible, consider network segmentation to restrict access to Triton endpoints and implement rate limiting or input validation to reject excessively compressed payloads at the network edge.

Patch guidance

Check NVIDIA's official security advisories and the Triton Inference Server GitHub repository for released patches. Patches should be applied promptly to all Triton instances, especially those exposed to untrusted networks or public APIs. Upgrade procedures vary by deployment method (container, binary, or package manager installation); consult NVIDIA's release notes for your specific deployment. Validate patch application by confirming version numbers post-update and conducting functional testing of inference workloads.

Detection guidance

Monitor Triton Inference Server logs and system metrics for unexpected process crashes, resource exhaustion, or connection drops. Implement network-level detection by inspecting incoming requests for anomalously high compression ratios or payloads with unusual compression characteristics. Host-based intrusion detection may flag attempts to send deeply nested or algorithmically complex compressed data. Alert on repeated failed requests from the same source, as attackers may probe for vulnerability presence before launching a sustained denial-of-service attack.

Why prioritize this

Despite the absence of active exploitation, this vulnerability merits prompt attention due to its HIGH CVSS score (7.5), network accessibility, and operational impact. Organizations hosting Triton in cloud or containerized environments should prioritize it within their patch cycle, particularly if the service is customer-facing or critical to production pipelines. The low attack complexity makes this a likely target once proof-of-concept code emerges.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network-based attack vector, no authentication requirement, and high availability impact. The attack complexity is low and no user interaction is needed, widening the attack surface. However, confidentiality and integrity are not affected, preventing a critical rating. Organizations should treat this as a high-priority patch, particularly in externally-accessible deployments.

Frequently asked questions