The NVIDIA DCGM Exporter contains an unauthenticated resource exhaustion vulnerability that can lead to significant service degradation or denial of service.

This vulnerability, categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), allows an unauthenticated remote attacker to submit concurrent requests to the debug endpoints, exhausting system resources.

The ability for unauthenticated actors to trigger resource exhaustion poses a high risk to availability, which is reflected in the CVSS score of 8.2. Successful exploitation can result in the disruption of critical monitoring services, potentially masking other malicious activities or causing operational downtime for systems relying on DCGM for performance metrics.

Immediate Action: Update NVIDIA DCGM and DCGM Exporter to the latest versions provided by the vendor, which include the necessary resource limits.

Proactive Monitoring: Monitor system resource usage and network traffic logs for spikes in concurrent requests targeting the debug endpoints.

Compensating Controls: Implement network-level access controls or a Web Application Firewall to restrict access to the /debug/pprof endpoints to authorized IP addresses only.

Public Exploit Available: Unknown.

Given the high severity and the ease of exploitation, administrators should prioritize updating these components immediately. Failure to patch allows unauthenticated attackers to potentially crash monitoring services, creating an unnecessary risk to system observability and stability.