CVE-2025-23317 is a critical (CVSS 9.1) heap-related flaw in the HTTP server of NVIDIA Triton Inference Server. A specially crafted HTTP request could lead to remote code execution, denial of service, data tampering or information disclosure. NVIDIA lists versions prior to 25.07 as affected, so upgrade to 25.07 or later.
What's affected
NVIDIA's August 2025 security bulletin for Triton Inference Server, released on 6 August 2025, lists Windows and Linux with a different fixed release depending on the CVE. For this one, all versions prior to 25.07 are affected and 25.07 is the updated version. The vector is AV:N/AC:L/PR:N/UI:N: network reachable, low complexity, no privileges and no user interaction. NVIDIA credits Trend Micro's Zero Day Initiative users for this report.
The same bulletin lists many other Triton CVEs fixed in releases 25.05, 25.06 and 25.07, so a server older than 25.07 is exposed to several issues at once. The bulletin's notes advise production users to follow the Secure Deployment Considerations Guide.
How to check if you're exposed
Find the Triton release you run. Most deployments use NVIDIA's container images, which carry a YY.MM tag.
docker images | grep -i tritonserver
tritonserver --version
Compare the result with the fixed release for your CVE. Then look at how the server is exposed. The bulletin's notes say production users should follow the Secure Deployment Considerations Guide and make sure logging and shared memory APIs are protected for use by authorized users. Check which networks can reach the HTTP and gRPC ports, and whether those management style APIs are open to anyone.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade Triton Inference Server to 25.07 or later, using the release on the Triton GitHub releases page.
- Rebuild and redeploy any container image that pins an older tag.
- Follow NVIDIA's Secure Deployment Considerations Guide, and make sure logging and shared memory APIs are limited to authorized users.
- Keep the inference ports on a private network or behind an authenticated gateway.
- Review other Triton CVEs in the same bulletin so one upgrade covers them all.
Why it matters
CWE-122 is a heap-based buffer overflow. NVIDIA's description says the HTTP server can be made to start a reverse shell by a crafted request. This guide does not repeat the technique, and the bulletin does not provide one.
Inference servers are often deployed quickly, on trusted networks, with few of the controls a public web service would have. A flaw in the HTTP front end changes that assumption, because anyone who can send a request to the port can reach the vulnerable code. The record does not mark the CVE as exploited and the KEV flag is false. Still, a critical, unauthenticated issue on an AI serving platform should be handled as a priority.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What fixes CVE-2025-23317?
NVIDIA lists Triton 25.07 as the updated version. All versions prior to 25.07 are affected.
Does the attacker need to log in?
The CVSS vector shows no privileges and no user interaction, so the HTTP server can be reached over the network without credentials.
Sources
Last reviewed: 19 October 2026.
