CVE-2026-111160— LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
Quick assessment
Affected
ModelTC LightLLM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LightLLM 1.2.0 及之前版本存在一个拒绝服务漏洞，攻击者无需认证，即可通过向 接口提供 内部字段，导致推理工作器崩溃。攻击者可以发送单个请求，其参数会使 中的 调用失败，从而终止推理线程。此时， 健康检查接口仍保持正常运行，但后续所有请求将挂起，直到服务重启。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111160
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
Source: CVE Program / CVE List V5
Vulnerability Description
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-111160
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111160
请登录查看更多情报信息。
Other References for CVE-2026-111160 (1)
Other References for CVE-2026-111160 (5)
-
-
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_lightllm.py#L37-L43 technical-description
IV. Related Vulnerabilities
Same product: LightLLM
-
CVE-2026-103395
LightLLM through 1.2.0 Unauthenticated Remote Code Execution -
CVE-2026-103270
LightLLM through 1.2.0 Missing Authentication on RL Control -
CVE-2026-103243
LightLLM through 1.2.0 Server-Side Request Forgery via multi -
CVE-2026-103042
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via -
CVE-2026-103041
LightLLM through 1.2.0 Unauthenticated Remote Code Execution
Same vendor: ModelTC
-
CVE-2026-108943
ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.f -
CVE-2026-103395
LightLLM through 1.2.0 Unauthenticated Remote Code Execution -
CVE-2026-103270
LightLLM through 1.2.0 Missing Authentication on RL Control -
CVE-2026-103243
LightLLM through 1.2.0 Server-Side Request Forgery via multi -
CVE-2026-103042
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via
Same weakness: CWE-502
-
CVE-2026-110874
Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnseri -
CVE-2026-47218
runwasi: Forged Wasmtime precompiled OCI layer bypasses runw -
CVE-2026-110812
Deserialization of untrusted data in the Gremlin graph-impor -
CVE-2026-111094
TeamCity<2026.2远程代码执行漏洞 -
CVE-2026-47168
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserializa
V. Comments for CVE-2026-111160
No comments yet