Memory Exhaustion Vulnerability in InternLM LMDeploy by InternLM

CVE-2026-92983

What is CVE-2026-92983?

Replicating issues in InternLM LMDeploy versions up to 0.17.0 can result in significant memory exhaustion caused by improper handling of session IDs. The software's failure to release scheduler sessions properly, utilizing user-facing session identifiers instead of internal keys, allows unauthenticated attackers to exploit the proxy endpoint. This opens the doorway for malicious actors to send completion requests, accumulating unreleased scheduler metadata and leading to potential out-of-memory conditions, disrupting normal operations.

References