Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-92971InternLM LMDeploy through 0.17.0 Assertion Denial of Service
High 7.5
In plain English
A high-severity security flaw in lmdeploy from InternLM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 46.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.
Affected products (as reported)
Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Issue #4965 issue-tracking
- https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/pytorch/engine/engine_loop.py#L560-L564 technical-description
- https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/serve/openai/endpoints/completions.py#L130-L136 technical-description
- https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/pytorch/utils.py#L187-L214 technical-description
- https://github.com/InternLM/lmdeploy product
- VulnCheck Advisory: InternLM LMDeploy through 0.17.0 Assertion Denial of Service third-party-advisory