CVE-2026-92971— InternLM LMDeploy through 0.17.0 Assertion Denial of Service
Quick assessment
Affected
InternLM lmdeploy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
InternLM LMDeploy 在 0.17.0 及更早版本中存在一个可触发的断言漏洞，位于 DistServe 解码迁移循环中，允许未经身份验证的攻击者终止推理引擎。攻击者可以提交一个包含空 列表的迁移请求（migration_request），从而触发 AssertionError，导致引擎主循环崩溃，并使得后续的推理请求全部失败。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92971
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
InternLM LMDeploy through 0.17.0 Assertion Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92971
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92971
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-92971 (1)
Vendor Advisories for CVE-2026-92971 (1)
Proof of Concept for CVE-2026-92971 (1)
Other References for CVE-2026-92971 (2)
IV. Related Vulnerabilities
Same product: lmdeploy
-
CVE-2026-92983
InternLM LMDeploy through 0.17.0 Memory Exhaustion via Sessi -
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization -
CVE-2026-76850
LMDeploy Remote Code Execution via Unsafe Pickle Deserializa -
CVE-2026-63764
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypas -
CVE-2026-46517
LMDeploy: Hardcoded trust_remote_code=True is an implicit un
Same vendor: InternLM
-
CVE-2026-92983
InternLM LMDeploy through 0.17.0 Memory Exhaustion via Sessi -
CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization -
CVE-2026-76850
LMDeploy Remote Code Execution via Unsafe Pickle Deserializa -
CVE-2026-63764
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypas -
CVE-2026-46517
LMDeploy: Hardcoded trust_remote_code=True is an implicit un
Same weakness: CWE-617
-
CVE-2026-8674
Assertion failure in the DNS stub resolver with a long searc -
CVE-2026-92416
Open5GS PFCP Session Report Request n4-handler.c smf_n4_hand -
CVE-2026-80274
Validating resolver can abort while caching a mismatched NOQ -
CVE-2026-76163
named aborts on a TKEY query when the user configuration has -
CVE-2026-73438
Security Advisory 0172
V. Comments for CVE-2026-92971
No comments yet