CVE-2025-33254: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2025-33254 is a race condition vulnerability in NVIDIA Triton Inference Server that allows an attacker to cause internal state corruption, leading to a denial of service. It affects all versions of Triton Inference Server prior to 26.01. The vulnerability was disclosed on March 24, 2026, with an initial NVD analysis completed on March 30, 2026. It carries a CVSS v3.1 base score of 7.5 (High), assigned by NVIDIA Corporation (Feedly, NVIDIA Advisory).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e., Race Condition), as assigned by NVIDIA Corporation. An attacker can exploit this vulnerability remotely over the network without authentication or user interaction by sending crafted requests that trigger a race condition, corrupting the server's internal state. The attack vector is network-accessible, requires low complexity, and no privileges, making it straightforward to trigger. No public proof-of-concept code has been identified at this time (Feedly, NVIDIA Advisory).

Successful exploitation results in a denial of service by corrupting the internal state of the NVIDIA Triton Inference Server, causing it to become unavailable. There is no reported impact on confidentiality or integrity — the vulnerability is limited to availability. Organizations relying on Triton Inference Server for AI/ML inference workloads could experience service disruption, potentially affecting downstream applications and pipelines that depend on the server (Feedly, NVIDIA Advisory).

NVIDIA has released a patch addressing this vulnerability in Triton Inference Server version 26.01 and later. Users should upgrade to version 26.01 or newer as the primary remediation. Until patching is possible, organizations should restrict network access to Triton Inference Server endpoints using firewalls or network segmentation to limit exposure to untrusted clients. Monitor NVIDIA's product security page for additional guidance (NVIDIA Advisory, NVIDIA Security).

Security news outlets including GBHackers, CyberPress, and CyberSecurityNews covered the vulnerability as part of broader reporting on NVIDIA patching multiple flaws, including critical RCE vulnerabilities in AI-related products. The vulnerability received limited individual attention, with most coverage bundled alongside other NVIDIA advisories released around the same time. Social media activity was minimal, with automated CVE tracking accounts on Bluesky and Mastodon noting the disclosure (GBHackers, CyberSecurityNews).