CVE-2026-24174
Published: 07 April 2026
Summary
CVE-2026-24174 is a high-severity Incorrect Conversion between Numeric Types (CWE-681) vulnerability in Nvidia Triton Inference Server. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 16.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-24174 by identifying, testing, and installing the vendor patch to remediate the server crash vulnerability.
Protects the Triton Inference Server against denial-of-service from malformed requests by restricting resource use and mitigating attack traffic.
Validates malformed requests sent to the NVIDIA Triton Inference Server to prevent exploitation leading to crashes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to application/system exploitation for endpoint DoS via remote malformed request causing crash.
NVD Description
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the server. A successful exploit of this vulnerability might lead to denial of service.
Deeper analysisAI
CVE-2026-24174 is a vulnerability in the NVIDIA Triton Inference Server that enables an attacker to cause a server crash by sending a malformed request. This issue, published on 2026-04-07, is classified under CWE-681 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
The vulnerability can be exploited by any unauthenticated attacker with network access to the server, requiring low attack complexity and no user interaction. Successful exploitation leads to a denial-of-service condition through server crashes, with no impact on confidentiality or integrity.
Mitigation details are available in official advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5816, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24174, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24174.
Details
- CWE(s)