Vulnerabilidades do ModelTC LightLLM
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam ModelTC LightLLM: 2 registro(s), com versões afetadas e correções.
CVE-2026-111160
Alta · 7.5
CWE-502 15/10/2026
LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
CVE-2026-26220
Crítica · 9.3
CWE-502 17/02/2026
LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE
LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() without authentication or validation. A remote attacker who can reach the PD master can send a crafted payload to achieve arbitrary code execution.