CVE-2026-111160

LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pdkvtransparams field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in...

EUVD-2026-102287

LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pdkvtransparams field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in...

CVE-2026-111160

LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pdkvtransparams field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in...

CVE-2026-111160: Deserialization of Untrusted Data

LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pdkvtransparams field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in...

PT-2026-115166

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description An unauthenticated attacker can cause a denial of service by sending a request to the '/generate' endpoint containing the pd kv trans params field. This triggers a failure in the pickle.loads functi...

ModelTC LightLLM deserialization injection vulnerability

ModelTC LightLLM 1.2.0 and earlier versions have a deserialization injection vulnerability. This vulnerability arises when unverified attackers provide the internal pdkvtransparams field to the /generate endpoint, causing pickle.loads to fail in InferSamplingParams. This can lead to the collapse ...