Denial of Service in NVIDIA Triton Inference Server via Malformed Model Input Tensor
Overview
A denial-of-service vulnerability was found in the NVIDIA Triton Inference Server. The vulnerability can be triggered by sending a specially crafted inference request to a loaded model. An unauthenticated remote attacker can exploit this by providing an input tensor with mismatched dimensions or an invalid data type in the request payload. The server's input validation layer for certain backends (specifically TensorRT and ONNX Runtime) failed to properly sanitize the metadata of the input tensor before passing it to the underlying model execution engine. This led to an out-of-bounds memory read or an unhandled exception deep within the C++ backend, causing the main `tritonserver` process to crash. Since a single Triton instance often serves multiple models for various applications, this crash results in a denial of service for all models hosted on that instance, disrupting all dependent services. The vulnerability requires the attacker to know the name and expected input schema of a model on the server but does not require any authentication. The impact is limited to service availability, as it does not lead to code execution or data leakage.
Affected Systems
Testing Guide
1. Check the version of your running Triton Inference Server. You can typically find this in container logs or by running `tritonserver --version`. 2. If the version is below 2.58.0, you are affected. 3. In a non-production environment, send an inference request to a loaded model using the Triton client API, but deliberately craft the input tensor with dimensions that do not match the model's configuration. For example, if the model expects a `[1, 3, 224, 224]` tensor, send one with `shape: [1, 3, 256, 256]`. If the server process crashes instead of returning a graceful error, the vulnerability is confirmed.
Mitigation Steps
1. Upgrade NVIDIA Triton Inference Server to version 2.58.0 or newer. 2. Implement a reverse proxy or API gateway in front of the Triton server to perform stricter input validation on inference requests before they reach the server. 3. Configure monitoring and alerting on the Triton server process to detect crashes and enable automated restarts to minimize downtime.
Patch Details
Patched in NVIDIA Triton Inference Server version 2.58.0, included in the NVIDIA AI Enterprise 25.11 driver release.