CVE-2026-92971 — InternLM LMDeploy through 0.17.0 Assertion Denial of Service
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the infer…
Published: 2026-09-17 · CVSS: 8.7 · CVSS 4.0
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7