InternLM lmdeploy versions up to 0.17.0 contain a reachable assertion vulnerability in the DistServe decode migration loop. An attacker can send a migration_request with an empty remote_block_ids list, which triggers an AssertionError that crashes the inference engine's processing loop. This vulnerability allows unauthenticated attackers to cause a denial of service by terminating the inference engine, preventing further inference requests from being processed.

The vulnerability enables unauthenticated attackers to cause a denial of service by crashing the inference engine, resulting in failure of subsequent inference requests. There is no indication of privilege escalation, data disclosure, or code execution beyond service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider implementing input validation or filtering to block migration_request messages with empty remote_block_ids if possible.