Memory Exhaustion Vulnerability in LightLLM by ModelTC
CVE-2026-103042

8.7HIGH

Key Information:

Vendor

Modeltc

Status
Lightllm
Vendor
CVE Published:
29 September 2026

What is CVE-2026-103042?

LightLLM versions up to 1.2.0 are susceptible to a memory exhaustion vulnerability within the NCCL control channel when initiated with the --pd_trans_mode nccl option. This issue allows unauthenticated attackers to overload the KV-transfer worker memory by calling the exposed_set_value method, enabling the storage of unbounded key-value pairs. The lack of size constraints leads to worker process crashes and can cause failures across nodes, posing a significant risk if exploited.

Affected Version(s)

LightLLM 0 <= 1.2.0

References

https://github.com/ModelTC/LightLLM/issues/1595
issue-tracking
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/...
technical-description
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingkai Yu
Jiapeng Li
Jiajia Liu
.