Threat Intelligence Database

CVE-2026-92983 is a high-severity vulnerability in InternLM lmdeploy versions up to 0.17.0. The issue occurs in DistServe prefill/decode disaggregation mode where scheduler sessions are not properly released due to the proxy using user-facing session IDs instead of internal scheduler keys. This allows unauthenticated attackers to send completion requests that cause unreleased scheduler metadata and memory accumulation, potentially leading to out-of-memory termination of the prefill worker.

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

LMDeploy versions prior to 0.12.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The vulnerability arises because the load_image() function fetches arbitrary URLs without validating whether the addresses are internal or private. This flaw allows attackers to potentially access internal network resources, including cloud metadata services. The issue is fixed in version 0.12.3.