NVIDIA Triton Inference Server is susceptible to a denial of service vulnerability that allows unauthenticated remote attackers to crash the service by sending malformed request headers.

The vulnerability is categorized as an uncaught exception (CWE-248) occurring during the processing of request headers. This flaw is exploitable by an unauthenticated attacker over the network with low attack complexity.

Successful exploitation of this vulnerability results in a denial of service, rendering the inference server unavailable for legitimate traffic. Given the critical role of inference servers in production machine learning pipelines, this disruption can lead to significant operational downtime and service degradation. The CVSS score of 7.5 reflects the high impact on service availability despite the lack of data confidentiality or integrity compromise.

Immediate Action: Upgrade NVIDIA Triton Inference Server to version r26.02 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor server logs and system health metrics for sudden service terminations or abnormal request patterns preceding a crash.

Compensating Controls: Implement a Web Application Firewall (WAF) or an API gateway to filter incoming traffic and drop requests containing malformed headers before they reach the inference server.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Organizations utilizing NVIDIA Triton Inference Server should prioritize the update to version r26.02 to eliminate this denial of service risk. Since the vulnerability is remotely exploitable without authentication, prompt remediation is necessary to maintain service continuity and prevent potential operational disruptions.