# CVE-2026-92983: InternLM LMDeploy memory leak in DistServe disaggregation mode

Source: https://junglewise.ai/threats/cve-2026-92983-internlm-lmdeploy-memory-leak-in-distserve-disaggregation-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92983 · Severity: high · CVSS 7.5 · Published 2026-09-17

InternLM LMDeploy is a toolkit for deploying and serving large language models. When configured in DistServe prefill/decode disaggregation mode, the service fails to properly clean up internal scheduler sessions, allowing unauthenticated attackers to trigger out-of-memory conditions on worker nodes by sending repeated completion requests, leading to service unavailability.

## Quick answers

**Is CVE-2026-92983 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92983 being exploited in the wild.

**How severe is CVE-2026-92983?** High severity, with a CVSS score of 7.5, published 17 September 2026.

**Which products and versions are affected?** InternLM LMDeploy through 0.17.0.

**Is there a fix for CVE-2026-92983?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92983 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92983?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a resource exhaustion vulnerability in LMDeploy's DistServe prefill/decode disaggregation mode. The root cause is that the proxy component uses user-facing session IDs instead of internal scheduler keys when managing sessions, causing scheduler sessions to never be released. Attackers with network access to the proxy endpoint can send completion requests without authentication, which accumulate unreleased scheduler metadata and GPU/CPU memory until the prefill worker process is killed out-of-memory. The vulnerability affects LMDeploy through version 0.17.0 and is exploitable remotely without authentication or user interaction. A patch is expected in a newer release.

## Affected products

- InternLM LMDeploy through 0.17.0

## Timeline

- 2026-09-17: disclosed

## References

- [https://github.com/InternLM/lmdeploy](https://github.com/InternLM/lmdeploy)
- [https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/pytorch/disagg/conn/engine_conn.py](https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/pytorch/disagg/conn/engine_conn.py)