CVE-2026-92971

Published: Sep 17, 2026Modified: Sep 22, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (7)

https://github.com/InternLM/lmdeploy

Source: disclosure@vulncheck.com

https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/pytorch/engine/engine_loop.py#L560-L564

Source: disclosure@vulncheck.com

https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/pytorch/utils.py#L187-L214

Source: disclosure@vulncheck.com

https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/serve/openai/endpoints/completions.py#L130-L136

Source: disclosure@vulncheck.com

https://github.com/InternLM/lmdeploy/issues/4965

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/internlm-lmdeploy-through-0.17.0-assertion-denial-of-service

Source: disclosure@vulncheck.com

https://github.com/InternLM/lmdeploy/issues/4965

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.