Internlm
Monthly
Memory exhaustion in InternLM LMDeploy through 0.17.0 can be triggered by unauthenticated remote attackers who send repeated completion requests to the proxy endpoint when the system runs in DistServe prefill/decode disaggregation mode. The proxy uses user-facing session IDs instead of internal scheduler keys, so scheduler sessions are never released, causing unbounded metadata and memory accumulation that eventually OOM-kills the prefill worker. This is a scope-limited availability threat-only the non-default disaggregated topology is affected, no data is exposed or corrupted, and no public exploit code has been identified at the time of analysis.
Denial of service in InternLM LMDeploy through 0.17.0 lets unauthenticated remote attackers crash the distributed inference engine by sending a migration_request whose remote_block_ids list is empty, which trips a reachable assertion in the DistServe decode migration loop and terminates the engine so that all subsequent inference requests fail (CWE-617, CVSS 4.0 8.7; availability-only, VC:N/VI:N/VA:H). Exploitation requires the target to be running in DistServe disaggregated prefill-decode serving mode with the migration path reachable - a non-default, multi-node topology that is the primary limiting factor, since standard single-node deployments are not exposed through this path. Given that configuration, no authentication or user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in InternLM LMDeploy versions 0.9.1 through 0.10.1 allows unauthenticated network attackers to run arbitrary commands by sending crafted pickle payloads to the AsyncRPCServer RPC endpoint (zmq_rpc.py). The service deserializes raw messages with pickle.loads() and performs no authentication or IP validation, so any attacker who can reach the randomized port-typically found by scanning-can trigger code execution; publicly available exploit code exists (proof-of-concept with reverse shell demo), and the CVSS 3.1 score is 9.8. This is not confirmed actively exploited (no CISA KEV listing), and exploitation is not possible if the RPC service is bound exclusively to localhost; upgrading to 0.10.2 patches the deserialization flaw and restricts the RPC to localhost.
Unauthenticated remote code execution in InternLM LMDeploy (versions 0.9.2 through 0.15.x) allows a remote attacker to execute arbitrary code inside an inference engine process when disaggregated (P2P) serving is enabled. The disaggregation peer-connector deserializes attacker-influenced ZMQ messages with Python pickle before any type validation, and the /distserve/p2p_initialize and /distserve/p2p_connect endpoints require no authentication in the default configuration (api_keys=None). Reported by VulnCheck with a vendor advisory and a public patch; no public exploit or CISA KEV listing identified at time of analysis, though the code path and fix are publicly documented on GitHub.
Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attackers coerce the server into fetching internal-only resources by abusing the image_url media-fetch path. Because the URL safety check validates only the initial URL and does not re-validate targets after an HTTP 302 redirect, an attacker-hosted endpoint can redirect the fetch to loopback services or cloud instance-metadata endpoints, exposing internal services and potentially cloud credentials. No public exploit is identified at time of analysis, EPSS is low (0.28%), and a vendor fix adding a media-domain allowlist is available.
Server-Side Request Forgery (SSRF) in InternLM LMDeploy's vision-language module allows remote unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources through unvalidated URL fetching in the load_image() function. Affects all versions prior to 0.12.3. EPSS score not available; no public exploit identified at time of analysis. Patch released in version 0.12.3.
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Memory exhaustion in InternLM LMDeploy through 0.17.0 can be triggered by unauthenticated remote attackers who send repeated completion requests to the proxy endpoint when the system runs in DistServe prefill/decode disaggregation mode. The proxy uses user-facing session IDs instead of internal scheduler keys, so scheduler sessions are never released, causing unbounded metadata and memory accumulation that eventually OOM-kills the prefill worker. This is a scope-limited availability threat-only the non-default disaggregated topology is affected, no data is exposed or corrupted, and no public exploit code has been identified at the time of analysis.
Denial of service in InternLM LMDeploy through 0.17.0 lets unauthenticated remote attackers crash the distributed inference engine by sending a migration_request whose remote_block_ids list is empty, which trips a reachable assertion in the DistServe decode migration loop and terminates the engine so that all subsequent inference requests fail (CWE-617, CVSS 4.0 8.7; availability-only, VC:N/VI:N/VA:H). Exploitation requires the target to be running in DistServe disaggregated prefill-decode serving mode with the migration path reachable - a non-default, multi-node topology that is the primary limiting factor, since standard single-node deployments are not exposed through this path. Given that configuration, no authentication or user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote code execution in InternLM LMDeploy versions 0.9.1 through 0.10.1 allows unauthenticated network attackers to run arbitrary commands by sending crafted pickle payloads to the AsyncRPCServer RPC endpoint (zmq_rpc.py). The service deserializes raw messages with pickle.loads() and performs no authentication or IP validation, so any attacker who can reach the randomized port-typically found by scanning-can trigger code execution; publicly available exploit code exists (proof-of-concept with reverse shell demo), and the CVSS 3.1 score is 9.8. This is not confirmed actively exploited (no CISA KEV listing), and exploitation is not possible if the RPC service is bound exclusively to localhost; upgrading to 0.10.2 patches the deserialization flaw and restricts the RPC to localhost.
Unauthenticated remote code execution in InternLM LMDeploy (versions 0.9.2 through 0.15.x) allows a remote attacker to execute arbitrary code inside an inference engine process when disaggregated (P2P) serving is enabled. The disaggregation peer-connector deserializes attacker-influenced ZMQ messages with Python pickle before any type validation, and the /distserve/p2p_initialize and /distserve/p2p_connect endpoints require no authentication in the default configuration (api_keys=None). Reported by VulnCheck with a vendor advisory and a public patch; no public exploit or CISA KEV listing identified at time of analysis, though the code path and fix are publicly documented on GitHub.
Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attackers coerce the server into fetching internal-only resources by abusing the image_url media-fetch path. Because the URL safety check validates only the initial URL and does not re-validate targets after an HTTP 302 redirect, an attacker-hosted endpoint can redirect the fetch to loopback services or cloud instance-metadata endpoints, exposing internal services and potentially cloud credentials. No public exploit is identified at time of analysis, EPSS is low (0.28%), and a vendor fix adding a media-domain allowlist is available.
Server-Side Request Forgery (SSRF) in InternLM LMDeploy's vision-language module allows remote unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources through unvalidated URL fetching in the load_image() function. Affects all versions prior to 0.12.3. EPSS score not available; no public exploit identified at time of analysis. Patch released in version 0.12.3.
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.