CVE-2025-23316 / CVE-2025-23268 / CVE-2025-23331: Command Injection and DoS in the September 2025 Triton Bulletin
| CVE | Score | Type | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2025-23316 | 9.8 Critical | OS command injection — Python backend | v25.08 | September 16, 2025 |
| CVE-2025-23268 | 8.0 High | Improper input validation — DALI backend | v25.08 | September 16, 2025 |
| CVE-2025-23331 | Medium | DoS via unbounded memory allocation | v25.08 | September 16, 2025 |
CVE-2025-23268 reported via Trend Micro Zero Day Initiative.
For executives
Six weeks after patching seven critical vulnerabilities in Triton Inference Server, NVIDIA published a further bulletin. CVE-2025-23316 is a command injection flaw in Triton's model control API. An attacker who sends a crafted model name to that API can execute arbitrary OS commands on the server — no authentication, no existing access, nothing but a network connection and a malformed string. CVSS 9.8.
The flaw: CVE-2025-23316
The Python backend does not sanitise the model name parameter before incorporating it into system-level operations. An attacker can include shell metacharacters or command sequences in the model name — characters like ;, |, $(), or backticks — that the underlying OS interprets as separate commands to execute. This is OS command injection (CWE-78).
CVE-2025-23268: DALI backend input validation
NVIDIA's DALI (Data Augmentation Library for Inference) backend handles data preprocessing pipelines within Triton. CVE-2025-23268 is an improper input validation vulnerability where an attacker can cause code execution via a crafted request. CVSS 8.0.
CVE-2025-23331: denial of service via unbounded memory allocation
The HTTP and gRPC endpoints extract size parameters from the request body and use those parameters to allocate memory. CVE-2025-23331 is missing bounds checking on those size values. An attacker sends a single crafted request with an excessively large size field, crashing the server.
Patch and mitigation
Upgrade NVIDIA Triton Inference Server and its Python backend to version 25.08 or later.