CVE-2025-33201: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2025-33201 is a denial-of-service vulnerability in NVIDIA Triton Inference Server caused by improper handling of unusually large payloads. The flaw resides in the EVBufferToJson method, which fails to properly validate oversized input, resulting in an uncaught exception. All versions of Triton Inference Server prior to r25.10 on Linux are affected. It was disclosed on December 3, 2025, with a CVSS v3.1 base score of 7.5 (High) assigned by NVIDIA (NVIDIA Advisory, Red Hat CVE).

The vulnerability is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). Specifically, the EVBufferToJson method in Triton Inference Server does not validate the size of user-supplied payloads before processing, allowing an attacker to trigger an uncaught exception by sending an oversized HTTP request body. No authentication is required, and the attack is network-accessible with low complexity, meaning any remote unauthenticated attacker can trigger the condition. A proof-of-concept advisory was published by Zero Day Initiative (ZDI-26-061) on February 4, 2026 (ZDI Advisory, Red Hat CVE).

Successful exploitation causes a denial-of-service condition on the affected Triton Inference Server instance, crashing the inference service and disrupting production AI/ML workloads. There is no confidentiality or integrity impact — the vulnerability is limited to availability (HIGH). Organizations relying on Triton for real-time AI inference pipelines, including those in healthcare, autonomous systems, or financial services, could experience significant operational disruption if the service is rendered unavailable (NVIDIA Advisory, SecurityOnline).

A proof-of-concept exploit is publicly documented in ZDI advisory ZDI-26-061, published February 4, 2026 (ZDI Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.038%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Red Hat CVE).

1. Reconnaissance: Identify internet-facing or network-accessible NVIDIA Triton Inference Server instances running versions prior to r25.10, using tools like Shodan or Censys targeting Triton's default HTTP port (8000) or gRPC port (8001).
2. Craft oversized payload: Prepare an HTTP POST request with an abnormally large request body (e.g., several gigabytes or a payload exceeding the server's expected buffer limits) targeting a Triton inference endpoint such as /v2/models/<model>/infer.
3. Send malicious request: Transmit the crafted request to the Triton server without any authentication credentials, exploiting the lack of authentication requirements.
4. Trigger uncaught exception: The EVBufferToJson method attempts to process the oversized payload without proper size validation, causing an uncaught exception that crashes the Triton Inference Server process.
5. Achieve DoS: The server becomes unavailable, disrupting all inference services until manually restarted (ZDI Advisory, CyberSecurityNews).

• Network: Unusually large HTTP POST requests (multi-gigabyte or abnormally oversized bodies) to Triton Inference Server endpoints (e.g., /v2/models/*/infer) on ports 8000 or 8001; sudden spike in inbound traffic volume to Triton server.
• Logs: Triton server logs showing uncaught exceptions or crash stack traces originating from the EVBufferToJson function; abrupt service termination entries in system logs (e.g., journalctl or Docker container logs).
• Process: Unexpected termination or restart of the tritonserver process; container orchestration platforms (Kubernetes, Docker) logging repeated pod/container restarts for Triton deployments.
• Availability: Sudden unavailability of inference API endpoints with connection refused or timeout errors following large inbound requests.

NVIDIA has released a patch in Triton Inference Server version r25.10; all users running versions prior to r25.10 should upgrade immediately (NVIDIA Advisory). As a temporary workaround while patching, organizations should restrict network access to Triton Inference Server instances using firewalls or network policies, limiting exposure to trusted internal networks only. Additionally, deploying a reverse proxy or API gateway with request body size limits in front of Triton can help block oversized payloads before they reach the vulnerable service.

Security media outlets including CyberSecurityNews, SecurityOnline, and The Hacker News (weekly recap) covered the vulnerability, highlighting the risk to production AI deployments given the unauthenticated, network-accessible nature of the flaw (CyberSecurityNews, SecurityOnline, The Hacker News). CISA included the vulnerability in its weekly vulnerability bulletin for the week of December 1, 2025. Community sentiment emphasized urgency for organizations running Triton in production AI pipelines to patch promptly given the lack of authentication requirements.