LightLLM CVE-2026-111160

Exploitation requires network reachability to the LightLLM HTTP API and the ability to submit the internal pd_kv_trans_params parameter to the /generate endpoint - the description indicates this works against LightLLM through 1.2.0 without authentication and without special configuration, so any exposed instance is affected. The primary limiting factor is deployment topology rather than access control: these inference workers are commonly bound to internal or trusted networks, so practical exploitation depends on whether the /generate endpoint is reachable by the attacker. No user interaction, credentials, or non-default feature toggle is required; a single malformed request triggers the pickle.loads failure that kills the inference thread.

This is a credible, actionable availability threat despite having no confidentiality or integrity impact. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes a network-reachable, low-complexity, unauthenticated attack with high availability impact only, consistent with a single-request denial of service - the score of 8.7 is driven entirely by the VA:H availability dimension. A public exploit exists (referenced LightLLM GitHub issue #1629 and VulnCheck advisory), which raises practical risk above a theoretical CVSS-only finding. There is no CISA KEV listing and no EPSS score was supplied in the input, so while exploit code is public there is no evidence of active in-the-wild exploitation at this time; POC availability and active exploitation are distinct signals and should not be conflated. The signals are internally consistent (network vector in CVSS matches the description's /generate HTTP endpoint and unauthenticated access), so no contradiction needs flagging; the main unknown is real-world exposure, since these inference servers are frequently deployed on internal or trusted networks rather than the public internet, which would reduce the effective AV:N reachability.

An attacker who can reach the LightLLM inference server's HTTP API sends a single crafted POST to /generate that includes the internal pd_kv_trans_params field with a value that causes pickle.loads to fail inside InferSamplingParams, killing the inference worker thread. The /health endpoint keeps reporting healthy while all subsequent generation requests hang indefinitely until an operator restarts the service, denying the model-serving capability to all users. Public exploit code for this technique is available via the referenced GitHub issue and VulnCheck advisory.