NVIDIA DCGM Exporter Flaw Enables Unauthenticated DoS via `/debug/pprof`

NVIDIA disclosed CVE-2026-47483, a vulnerability in DCGM and DCGM Exporter that allows unauthenticated attackers to abuse exposed /debug/pprof diagnostic endpoints and trigger uncontrolled resource consumption. By sending many concurrent profiling requests, an attacker can exhaust CPU, memory, and file descriptors, causing the exporter to become unresponsive or crash. The issue affects all platforms within the impacted version ranges and carries a CVSS v3.1 score reflecting high availability impact with possible limited information disclosure.

Security advisories warn that exploitation can disrupt GPU monitoring, telemetry, and alerting, and prolonged abuse may also destabilize the host system. The exposed profiling interface may leak limited diagnostic data, including internal stack traces. Public guidance says there is no known exploitation so far, but the flaw is considered automatable; defenders are urged to deploy NVIDIA’s patched version and reduce exposure of the diagnostic endpoints through firewalling, authentication, rate limiting, and network isolation.