CVE-2025-23310 / CVE-2025-23311 / CVE-2025-23317: Stack and Heap Overflows in Triton's HTTP Layer
| CVE | Score | Type | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2025-23310 | 9.8 Critical | Stack buffer overflow | v25.07 | August 4, 2025 |
| CVE-2025-23311 | 9.8 Critical | Stack buffer overflow | v25.07 | August 4, 2025 |
| CVE-2025-23317 | 9.1 Critical | Heap buffer overflow / reverse shell | v25.07 | August 4, 2025 |
CVE-2025-23310 and CVE-2025-23311 discovered by Will Vandevanter (Trail of Bits).
For executives
The same August 2025 NVIDIA security bulletin that contained the Triton Python backend RCE chain also contained three separate critical vulnerabilities in Triton's HTTP layer. Each is independently exploitable with a single crafted HTTP request. CVE-2025-23317 allows an unauthenticated attacker to open a reverse shell on the Triton server directly. All three require no credentials and no user interaction.
The alloca() problem
Triton's HTTP server uses libevent for request handling. When an HTTP request arrives, libevent's evbuffer_peek() function returns the number of buffer segments needed to represent the full request body. That count is then passed directly as the size argument to alloca(). alloca() allocates memory on the current stack frame — when given attacker-controlled size input, the stack overflows.
HTTP chunked transfer encoding lets clients send data in multiple fragments. By sending a large number of small chunks, an attacker forces evbuffer_peek() to return a high segment count, which the server passes to alloca(). CVE-2025-23310 and CVE-2025-23311 affect different code paths within Triton's HTTP handling, meaning fixing one does not address the other.
CVE-2025-23317: the reverse shell
CVE-2025-23317 is a heap-based buffer overflow. The documented outcome, per NVIDIA's own bulletin, is that an attacker can start a reverse shell. A single crafted HTTP request opens a command channel from the Triton server back to the attacker's controlled infrastructure. CVSS 9.1. Unauthenticated. Network-accessible. No user interaction.
Patch and mitigation
Upgrade NVIDIA Triton Inference Server to version 25.07 or later. The Python backend must also be updated separately.