Executive brief
InternLM LMDeploy is a toolkit for deploying and serving large language models. When configured in DistServe prefill/decode disaggregation mode, the service fails to properly clean up internal scheduler sessions, allowing unauthenticated attackers to trigger out-of-memory conditions on worker nodes by sending repeated completion requests, leading to service unavailability.
Technical details
This is a resource exhaustion vulnerability in LMDeploy's DistServe prefill/decode disaggregation mode. The root cause is that the proxy component uses user-facing session IDs instead of internal scheduler keys when managing sessions, causing scheduler sessions to never be released. Attackers with network access to the proxy endpoint can send completion requests without authentication, which accumulate unreleased scheduler metadata and GPU/CPU memory until the prefill worker process is killed out-of-memory. The vulnerability affects LMDeploy through version 0.17.0 and is exploitable remotely without authentication or user interaction. A patch is expected in a newer release.
Affected products
- InternLM LMDeploy through 0.17.0
Timeline
- 2026-09-17: disclosed