CVE-2026-92971 InternLM LMDeploy through 0.17.0 Assertion Denial of Service
Unauthenticated attackers can crash the InternLM LMDeploy inference engine by submitting a migration request with empty block IDs, causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92971?
CVE-2026-92971 is a high-severity denial of service vulnerability in InternLM lmdeploy, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.
Weakness: CWE-617
Which versions are affected by CVE-2026-92971?
How do I fix CVE-2026-92971?
No fix has been published for CVE-2026-92971 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-92971 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92971 exists.
Sources
Also known as GHSA-3j7h-8qqw-4p7v.