CVE-2026-111160

Versions of LightLLM through 1.2.0 are vulnerable to a denial of service (DoS) condition. An unauthenticated attacker can crash the inference worker by sending a single request to the /generate endpoint containing the internal pd_kv_trans_params field. The vulnerability stems from the use of pick...

CVE-2026-111160 LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization

LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pdkvtransparams field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in...