CVE-2025-33238
Published: 24 March 2026
Summary
CVE-2025-33238 is a high-severity Race Condition (CWE-362) vulnerability in Nvidia Triton Inference Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediating the race condition flaw in NVIDIA Triton Inference Server via timely patching directly prevents remote attackers from triggering exceptions that cause denial of service.
Denial-of-service protection mechanisms limit the effects of exception-triggering requests on the Sagemaker HTTP server availability.
Robust error handling prevents exceptions from race conditions in the HTTP server from escalating to full denial of service.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing HTTP server component (T1190) directly causes application DoS via triggered exception from race condition (T1499.004).
NVD Description
NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerability may lead to denial of service.
Deeper analysisAI
CVE-2025-33238 is a vulnerability in the Sagemaker HTTP server component of NVIDIA Triton Inference Server, where an attacker can trigger an exception. Published on 2026-03-24, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability. The issue is associated with CWE-362 (race condition) and lacks additional CWE details from NVD.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation leads to a denial of service condition by causing an exception that disrupts server availability, without compromising confidentiality or integrity.
Mitigation guidance and patch details are available in the official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5790, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-33238, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33238.
Details
- CWE(s)