CVE-2025-23331: 
Triton Inference Server 脆弱性の分析と軽減

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability (CVE-2025-23331) where a user could cause a memory allocation with excessive size value, leading to a segmentation fault, by providing an invalid request. The vulnerability was discovered and disclosed on August 6, 2025, affecting all versions of Triton Inference Server prior to version 25.06 (NVIDIA Advisory, NVD).

The vulnerability is classified as CWE-789 (Memory Allocation with Excessive Size Value) with a CVSS v3.1 base score of 7.5 (High) and vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability allows remote attackers to cause a denial of service through excessive memory allocation, which results in a segmentation fault when processing invalid requests (NVIDIA Advisory).

A successful exploitation of this vulnerability can lead to denial of service conditions in affected Triton Inference Server installations. The high CVSS score of 7.5 indicates significant potential impact on system availability (NVIDIA Advisory).

NVIDIA has released version 25.06 of the Triton Inference Server to address this vulnerability. Users are strongly advised to update to this version or later. Additionally, users deploying Triton Inference Server in production settings should follow the Secure Deployment Considerations Guide and ensure that logging and shared memory APIs are protected for use by authorized users (NVIDIA Advisory).