CVE-2026-47482: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2026-47482 is a memory leak vulnerability in NVIDIA Triton Inference Server for Linux, classified under CWE-401 (Missing Release of Memory after Effective Lifetime). It affects all versions from 0.0 through 26.04 (inclusive). The vulnerability was disclosed on July 14, 2026, by NVIDIA Corporation and received a CVSS v3.1 base score of 7.5 (High), assigned by NVIDIA (NVD, EUVD).

The root cause is a missing release of memory after its effective lifetime (CWE-401), a form of memory leak that can be triggered remotely. The vulnerability is network-accessible, requires no authentication, no user interaction, and has low attack complexity, making it automatable according to CISA's SSVC assessment. An attacker can craft requests to the Triton Inference Server that cause memory to be allocated but never freed, progressively exhausting available memory resources (NVD).

Successful exploitation leads to a denial of service condition on the affected Linux host running NVIDIA Triton Inference Server. Because Triton is commonly used in AI/ML inference pipelines and production serving environments, an availability disruption could halt model inference workloads and downstream dependent services. There is no reported impact on confidentiality or integrity (NVD).

NVIDIA has identified all Triton Inference Server versions up to and including 26.04 as affected. Users should monitor the NVIDIA Product Security page for an official patch or updated container release. As an interim measure, restrict network access to Triton Inference Server endpoints using firewalls or network policies to limit exposure to untrusted clients, and monitor server memory utilization for anomalous growth indicative of a memory leak (NVD).