InternLM lmdeploy versions up to 0.17.0 contain a resource management vulnerability in DistServe prefill/decode disaggregation mode. The proxy incorrectly uses user-facing session IDs rather than internal scheduler keys to release scheduler sessions. As a result, unauthenticated attackers can send crafted completion requests to the proxy endpoint, causing scheduler metadata and memory to accumulate without release. This accumulation can exhaust memory resources, causing the prefill worker process to be killed due to out-of-memory conditions.

The vulnerability allows unauthenticated attackers to cause a denial-of-service condition by exhausting memory resources on the prefill worker through unreleased scheduler metadata accumulation. This can disrupt service availability by triggering out-of-memory kills of critical worker processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual memory usage patterns on the prefill worker and consider restricting access to the proxy endpoint to trusted users or networks to reduce exposure.