CVE-2026-92983 Details
Description
InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate unreleased scheduler metadata and memory until the prefill worker is out-of-memory killed.
A memory exhaustion vulnerability has been identified in InternLM LMDeploy versions through 0.17.0. This issue arises in DistServe prefill/decode disaggregation mode, where the application fails to properly release scheduler sessions. The problem is caused by the proxy using user-facing session IDs instead of internal scheduler keys. As a result, unauthenticated attackers can send completion requests to the proxy endpoint, leading to an accumulation of unreleased scheduler metadata and memory. This buildup continues until the prefill worker is out-of-memory killed.
Users can update to InternLM LMDeploy version 0.17.1 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InternLM/lmdeploy/issues/4967 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/InternLM/lmdeploy | [email protected] | Source CodeVendor |
| https://github.com/InternLM/lmdeploy/blob/v0.17.0/lmdeploy/pytorch/disagg/conn/engine_conn.py#L93-L99 | [email protected] | Source CodeVendor |
| https://github.com/InternLM/lmdeploy/issues/4967 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/internlm-lmdeploy-through-0.17.0-memory-exhaustion-via-session-id-mismatch | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-772 | Missing Release of Resource after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InternLM LMDeploy | <= 0.17.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |