An unauthenticated attacker can trigger a denial of service condition in the NVIDIA Triton Inference Server by sending a specifically crafted, malformed request to the system.

The vulnerability stems from an incorrect conversion between numeric types, classified as CWE-681. An unauthenticated attacker can exploit this flaw by sending a malformed request to the server, resulting in a crash and subsequent denial of service.

The ability for an unauthenticated remote actor to crash the inference server poses a significant risk to operational continuity. Because this vulnerability is automatable, it could be leveraged to disrupt machine learning pipelines and critical production services, leading to potential service outages. Given the CVSS score of 7.5, this is categorized as a High severity issue requiring prompt attention.

Immediate Action: Upgrade the NVIDIA Triton Inference Server to version r26.02 or later to apply the necessary security patches.

Proactive Monitoring: Monitor server logs for unexpected process terminations or frequent service restarts that may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall or an API gateway to inspect and sanitize incoming requests, blocking traffic that does not adhere to expected schema or format specifications.

Public Exploit Available: No (exploit_available: false)

The risk of a denial of service attack against core inference infrastructure necessitates immediate action. Administrators should verify the current version of their deployments and prioritize the upgrade to r26.02 across all environments. Failure to update leaves the server exposed to simple, automatable crash attempts that could severely impact business-critical AI services.