CVE-2026-92983 in LMDeploy
Summary
by MITRE • 09/17/2026
InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate unreleased scheduler metadata and memory until the prefill worker is out-of-memory killed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in InternLM LMDeploy versions up to 0.17.0, specifically within its DistServe prefill/decode disaggregation mode, represents a critical resource management flaw rooted in session lifecycle handling. In this architectural configuration, the system separates the computational heavy lifting of generating initial tokens (prefill) from the subsequent token generation steps (decode). The proxy component acts as an intermediary between client requests and these specialized workers. However, the implementation contains a logical error where the proxy utilizes user-facing session identifiers to manage state rather than mapping them correctly to internal scheduler keys that govern resource allocation on the worker nodes. This mismatch creates a disconnect in how sessions are tracked and terminated across the distributed components of the inference engine.
When an unauthenticated attacker sends completion requests to the proxy endpoint, each request initiates a new interaction context within the system. Because the proxy fails to properly release scheduler sessions using the correct internal identifiers, these contexts remain active on the prefill worker even after they should have been terminated or recycled. Over time, this leads to the accumulation of unreleased scheduler metadata and associated memory allocations for each malicious request. The flaw essentially allows an attacker to create a persistent state that consumes system resources without corresponding cleanup mechanisms being triggered by normal operational flows.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition through resource exhaustion. As the number of accumulated sessions grows, the prefill worker gradually depletes its available memory reserves. Eventually, the operating system or container runtime detects that the process has exceeded its memory limits and forcibly kills it to protect the host environment. This results in an abrupt termination of the inference service for all users relying on that specific worker node, causing significant downtime and potential data loss if stateful operations were interrupted mid-execution. The attack is particularly dangerous because it requires no authentication, allowing any network-accessible entity to trigger this degradation simply by sending requests.
From a classification perspective, this vulnerability aligns with CWE-401, which describes the missing release of memory after effective usage, and CWE-787, involving out-of-bounds write scenarios if the metadata corruption leads to buffer overflows in underlying structures. In terms of offensive security frameworks, it maps directly to MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via resource exhaustion. The attack vector leverages the system's own logic against itself by exploiting the gap between user-facing identifiers and internal management keys.
Mitigation strategies should focus on correcting the session mapping logic within the proxy component to ensure that every allocated scheduler key is properly released upon request completion or timeout. Immediate remediation involves upgrading LMDeploy to a version where this dissociation error has been patched, ensuring that internal state cleanup routines are robustly tied to actual resource deallocation events. In environments where patching is not immediately feasible, implementing strict rate limiting and input validation on the proxy endpoint can help mitigate the volume of requests an unauthenticated user can send before triggering memory exhaustion. Additionally, configuring lower memory limits for the prefill worker containers with automatic restart policies may limit the blast radius by ensuring rapid recovery from out-of-memory kills, although this does not address the root cause of the resource leak.