Uncovering memory corruption in NVIDIA Triton (as a new hire)
Summary: A Trail of Bits AI/ML security engineer, in his first month on the job, found two remotely accessible memory corruption bugs in NVIDIA's Triton Inference Server by running the Semgrep static analysis tool against the codebase and then using HTTP chunked transfer encoding to amplify an unsafe alloca allocation. The bugs affect Triton up to and including version 25.06, carry CVSS scores of 9.8 as CVE-2025-23310 and CVE-2025-23311, and were patched in release 25.07 on August 4, 2025.
What's compelling: With default configuration, a 3MB HTTP request is enough to crash the server, and authentication is optional on most routes and off by default - so the inference endpoints most Triton deployments expose to clients are reachable by an unauthenticated attacker, and at least one of the bugs was committed to Triton over five years ago.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-23310CVE-2025-23311CVE-2025-23334
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026