CVE-2026-111160 — LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_param…
Published: 2026-10-15 · CVSS: 8.7 · CVSS 4.0
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7