CVE-2026-24158: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2026-24158 is a denial-of-service vulnerability in NVIDIA Triton Inference Server's HTTP endpoint, where an unauthenticated attacker can trigger excessive memory allocation by sending a large compressed payload. It affects all versions of NVIDIA Triton Inference Server prior to version 26.01. The vulnerability was published on March 24, 2026, with an initial NVD analysis completed on March 30, 2026. It carries a CVSS v3.1 base score of 7.5 (High), assigned by NVIDIA Corporation (NVIDIA Advisory, Feedly).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value), where the HTTP endpoint fails to enforce limits on the size of decompressed payloads before allocating memory. An attacker exploits this by sending a crafted HTTP request containing a large compressed payload — a technique sometimes called a "zip bomb" or decompression bomb — causing the server to allocate an excessive amount of memory during decompression. No authentication, special privileges, or user interaction is required, making this exploitable by any network-accessible attacker. No public proof-of-concept code has been identified at this time (NVIDIA Advisory, Feedly).

Successful exploitation results in a denial-of-service condition, causing high availability impact with no effect on confidentiality or integrity. Legitimate users and dependent applications relying on the Triton Inference Server for AI inference operations would be unable to access the service during an attack. In production AI/ML environments, this could disrupt inference pipelines, model serving, and downstream applications that depend on real-time inference responses (Feedly, NVIDIA Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible NVIDIA Triton Inference Server instances running versions prior to 26.01 using network scanning tools such as Shodan, Censys, or nmap targeting default Triton HTTP ports (typically 8000).
2. Craft compressed payload: Prepare a highly compressed HTTP request body (e.g., a gzip or deflate "decompression bomb") that expands to an extremely large size upon decompression — a small compressed file that decompresses to gigabytes of data.
3. Send malicious request: Submit the crafted HTTP POST request with the large compressed payload to the Triton Inference Server's HTTP endpoint, including appropriate Content-Encoding headers (e.g., Content-Encoding: gzip) to trigger server-side decompression.
4. Trigger memory exhaustion: The server attempts to allocate memory proportional to the decompressed payload size, exhausting available memory and causing the service to become unresponsive or crash, resulting in denial of service for legitimate users (Feedly, NVIDIA Advisory).

• Network: Unusual HTTP POST requests to the Triton Inference Server HTTP endpoint (default port 8000) with Content-Encoding: gzip or Content-Encoding: deflate headers and abnormally small request body sizes that expand significantly upon decompression; repeated requests from a single or small set of source IPs.
• Logs: Triton Inference Server access logs showing HTTP requests with compressed payloads followed by server errors, out-of-memory exceptions, or service crashes; sudden spikes in memory usage correlated with specific HTTP requests.
• Process/System: Rapid increase in memory consumption by the Triton Inference Server process leading to OOM (out-of-memory) killer events on Linux hosts; unexpected service restarts or crashes of the tritonserver process.
• Availability: Sudden unavailability of the Triton HTTP endpoint coinciding with the above network or log indicators (Feedly).

NVIDIA has released a patch in Triton Inference Server version 26.01; all users running versions prior to 26.01 should upgrade immediately (NVIDIA Advisory). As interim mitigations, administrators should implement network-level access controls to restrict exposure of the Triton HTTP endpoint to trusted clients only, and configure rate limiting and maximum payload size restrictions at a reverse proxy or API gateway layer. Monitoring for anomalous compressed request patterns can also help detect exploitation attempts (Feedly).

Security news outlets including GBHackers, CyberPress, and CyberSecurityNews covered this vulnerability as part of broader reporting on NVIDIA's March 2026 security patch release, which also addressed critical RCE vulnerabilities in other NVIDIA products (GBHackers, CyberPress, CyberSecurityNews). Social media activity on Mastodon and Bluesky noted the disclosure shortly after publication. Community reaction was moderate, with primary concern focused on the unauthenticated nature of the attack vector and the potential impact on AI/ML production environments.