A critical denial of service vulnerability in NVIDIA Triton Inference Server allows unauthenticated attackers to crash the service via malformed requests.

The vulnerability stems from an integer overflow (CWE-190) within the server request processing logic. An unauthenticated remote attacker can trigger this flaw by sending a specifically crafted, malformed request, leading to a complete service crash.

The ability for an unauthenticated attacker to remotely crash the Triton Inference Server creates a significant risk to operational availability. Because this service is typically used for AI model deployment, unexpected downtime can disrupt critical machine learning pipelines and downstream business applications. Given the CVSS score of 7.5, this high severity flaw warrants immediate attention to maintain system uptime and service reliability.

Immediate Action: Update NVIDIA Triton Inference Server to version r26.02 or later to incorporate the vendor-supplied security fixes.

Proactive Monitoring: Monitor server logs and application performance metrics for recurring crashes or abnormal request patterns that may indicate exploitation attempts.

Compensating Controls: Implement rate limiting and input validation at the Web Application Firewall or API Gateway level to filter out malformed or anomalous requests before they reach the inference server.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a clear risk to the availability of critical inference infrastructure. Security teams should prioritize the deployment of the r26.02 update across all production environments to eliminate the underlying integer overflow flaw. Failure to patch may leave the system vulnerable to trivial denial of service attacks that require no authentication.