CVE-2026-92971highCWE-617

CVE-2026-92971: falha de alta gravidade em InternLM lmdeploy

InternLM LMDeploy through 0.17.0 Assertion Denial of Service

Publicada em

Seguir esta CVE+ Monitorar lmdeploy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
InternLM · lmdeploy
CVEs relacionadas — InternLM lmdeploy

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33626HIGHLMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingEPSS 45.3%CVE-2026-76850CRITICALLMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer ConnectorEPSS 1.3%CVE-2025-66455CRITICALLMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyEPSS 1.3%CVE-2026-119706CRITICALLMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle DeserializationEPSS 1.0%CVE-2025-59953CRITICALLMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeployEPSS 0.9%CVE-2026-92983HIGHInternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID MismatchEPSS 0.7%