Is CVE-2026-103042 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103042 being exploited in the wild.

How severe is CVE-2026-103042?

High severity, with a CVSS score of 7.5, published 29 September 2026.

Which products and versions are affected?

ModelTC LightLLM through 1.2.0.

Is there a fix for CVE-2026-103042?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103042 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103042?

Check whether you run ModelTC LightLLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103042: LightLLM memory exhaustion in NCCL control channel

CVE-2026-103042 · Severity: high · CVSS 7.5 · Published 2026-09-29

LightLLM is a framework for running large language models on distributed GPU clusters. When configured to use NCCL for cross-node communication (--pd_trans_mode nccl), it exposes an unauthenticated control service that allows any network attacker to exhaust worker memory by storing unbounded data, crashing the entire inference node and interrupting service.

Technologies: ModelTC LightLLM. Vendors: ModelTC.

Quick answers

Is CVE-2026-103042 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103042 being exploited in the wild.
How severe is CVE-2026-103042?: High severity, with a CVSS score of 7.5, published 29 September 2026.
Which products and versions are affected?: ModelTC LightLLM through 1.2.0.
Is there a fix for CVE-2026-103042?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103042 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103042?: Check whether you run ModelTC LightLLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The NCCL control channel in LightLLM's KV-transfer workers runs an unauthenticated RPyC service on ports 30000-40000 with the exposed_set_value method. This method stores caller-supplied key-value pairs in an unbounded Python dictionary with no size limits, entry limits, or expiration, allowing attackers with network access to exhaust memory. When the worker process is OOM-killed, a watchdog escalates the failure by forcibly terminating the entire router process tree with SIGKILL.

Affected products

ModelTC LightLLM through 1.2.0

Timeline

2026-09-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.