# CVE-2026-47628: NVIDIA Triton Inference Server resource exhaustion denial of service

Source: https://junglewise.ai/threats/cve-2026-47628-nvidia-triton-inference-server-resource-exhaustion-denial-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-47628 · Severity: high · CVSS 7.5 · Published 2026-08-18

NVIDIA Triton Inference Server is a widely-used inference platform that deploys machine learning models at scale. This vulnerability allows an attacker to trigger unlimited resource allocation, exhausting memory and CPU, which causes the service to become unavailable and disrupts AI model serving for dependent applications and users.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Nvidia Triton Inference Server](https://junglewise.ai/threats/technologies/triton-inference-server). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-47628 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47628 being exploited in the wild.

**How severe is CVE-2026-47628?** High severity, with a CVSS score of 7.5, published 18 August 2026.

**Which products and versions are affected?** Nvidia Triton Inference Server <UNKNOWN>.

**Is there a fix for CVE-2026-47628?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47628 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-47628?** Check whether you run Linux Kernel or Nvidia Triton Inference Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion / denial of service issue in NVIDIA Triton Inference Server for Linux where an attacker can trigger unbounded allocation of memory or other system resources. The flaw allows an attacker to exhaust available resources without limits, leading to denial of service. The attack vector appears to be network-based, though specific preconditions (such as authentication requirements or specific request types) are not detailed in the available advisory content. Patches or fixes from NVIDIA are expected as part of the security bulletin referenced in the advisory.

## Affected products

- NVIDIA Triton Inference Server <UNKNOWN>

## Timeline

- 2026-08-18: disclosed

## References

- [https://github.com/NVIDIA/product-security/tree/main/2026/5865](https://github.com/NVIDIA/product-security/tree/main/2026/5865)
- [https://www.cve.org/CVERecord?id=CVE-2026-47628](https://www.cve.org/CVERecord?id=CVE-2026-47628)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)