CVE-2026-92971 Details

A denial-of-service vulnerability has been identified in InternLM LMDeploy versions through 0.17.0. This issue arises from a reachable assertion in the DistServe decode migration loop, where unauthenticated attackers can disrupt the inference engine. By sending a migration_request with an empty remote_block_ids list, attackers trigger an AssertionError that crashes the engine loop, causing subsequent inference requests to fail. The vulnerability is rooted in insufficient validation of the migration_request field, allowing for the introduction of invalid data that disrupts the engine's operation.

As of now, there is no official patch available for this vulnerability. However, users can manually validate and sanitize migration_request fields before they reach the DistServe decode migration loop.