Threats tagged 'ghsa-mqxw-j6vh-r94f'

LightLLM versions up to 1.2.0 have a memory exhaustion vulnerability in the NCCL control channel when started with the --pd_trans_mode nccl option. This flaw allows unauthenticated attackers to invoke the exposed_set_value method to store unlimited key-value pairs without size restrictions, leading to exhaustion of KV-transfer worker memory. The resulting memory exhaustion causes the worker process to crash and triggers node failure.