CVE-2026-92983highCWE-772

CVE-2026-92983: falha de alta gravidade em InternLM lmdeploy

InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar lmdeploy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%
InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate unreleased scheduler metadata and memory until the prefill worker is out-of-memory killed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
InternLM · lmdeploy
CVEs relacionadas — InternLM lmdeploy

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33626HIGHLMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingEPSS 45.3%CVE-2026-76850CRITICALLMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer ConnectorEPSS 1.3%CVE-2025-66455CRITICALLMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyEPSS 1.3%CVE-2026-119706CRITICALLMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle DeserializationEPSS 1.0%CVE-2025-59953CRITICALLMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeployEPSS 0.9%CVE-2026-92971HIGHInternLM LMDeploy through 0.17.0 Assertion Denial of ServiceEPSS 0.7%