Introduction
Remote attackers can crash or take control of production AI inference servers with a single HTTP request. CVE-2025-23311 is a critical stack-based buffer overflow in NVIDIA Triton Inference Server, a platform widely used to deploy machine learning models at scale. An unauthenticated attacker can exploit it remotely, which puts the integrity and availability of AI workloads in enterprise and cloud environments at risk.
About NVIDIA Triton Inference Server: NVIDIA Triton Inference Server is open-source software for deploying AI models on GPUs, CPUs, and other hardware. Major enterprises and cloud providers use it to serve machine learning models for healthcare, finance, autonomous vehicles, and other applications. It is central to NVIDIA's AI software stack and runs production inference for thousands of organizations worldwide.
Technical information
CVE-2025-23311 is a stack-based buffer overflow (CWE-121) in all versions of NVIDIA Triton Inference Server up to and including 25.06. The flaw is in the HTTP request handling code, in its use of the alloca() function for stack allocation.
The vulnerable path runs when the server processes HTTP requests with libevent's evbuffer_peek() function. That function returns the number of buffer segments (iovec structures) needed to represent the HTTP request. The segment count then becomes the size argument to alloca(), which allocates an array of evbuffer_iovec structures on the stack. An attacker who can influence the number of segments can control the size of that stack allocation.
HTTP chunked transfer encoding lets clients send data in many small chunks. A request built from thousands of small chunks can make libevent split it into a large number of segments. Trail of Bits researchers showed that a 3MB HTTP request made of many small chunks can exhaust the stack and trigger a segmentation fault, which crashes the server. Each 6-byte chunk produces 16 bytes of stack allocation, so the amplification is significant.
Affected endpoints include:
- Inference requests
- Repository index requests
- Model load and unload operations
- Trace and logging configuration
- Shared memory registration
Authentication is optional and disabled by default for most endpoints, so an unauthenticated attacker can exploit this remotely.
The bug sat in the Triton codebase for more than five years. It was found through a mix of static analysis tools (such as Semgrep) and manual review. The root cause is missing bounds checking on a stack allocation whose size comes from untrusted input.
Patch information
NVIDIA has fixed multiple critical vulnerabilities in Triton Inference Server in version 25.07. The release addresses issues that could lead to remote code execution, denial of service, information disclosure, and data tampering. Users are strongly advised to upgrade to version 25.07, which is available on the Triton Inference Server Releases page on GitHub. (nvidia.custhelp.com)
Affected systems and versions
- NVIDIA Triton Inference Server versions up to and including 25.06 are affected.
- All deployments exposing HTTP endpoints are vulnerable, especially those with authentication disabled (the default configuration).
- The vulnerability affects multiple endpoints, including inference, repository index, and administrative operations.
Vendor security history
NVIDIA has fixed security issues across its hardware and software products before, including vulnerabilities in GPU drivers, container runtimes, and AI software platforms. For Triton Inference Server, the company responded quickly to the coordinated disclosures and shipped a patch within the coordinated timeline. Still, finding several related vulnerabilities in the same release cycle points to a need for better secure coding practices and more rigorous security testing in Triton's development lifecycle.
