EUVD-2026-81620

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

CVE-2026-92983

InternLM LMDeploy through 0.17.0 is affected by a memory exhaustion vulnerability in its DistServe prefill/decode disaggregation mode . The root cause is that the proxy uses user-facing session IDs instead of internal scheduler keys, causing scheduler sessions to never be released. An unauthentic...

CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

EUVD-2026-81580

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migrationrequest with an empty remoteblockids list to trigger an AssertionError that...

CVE-2026-92971

InternLM LMDeploy through version 0.17.0 contains an assertion-based denial-of-service vulnerability in the DistServe decode migration loop . An unauthenticated attacker can submit a migration_request with an empty remote_block_ids list, triggering an AssertionError that crashes the inference eng...

CVE-2026-92971 InternLM LMDeploy through 0.17.0 Assertion Denial of Service

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migrationrequest with an empty remoteblockids list to trigger an AssertionError that...