CVE-2026-92983: LMDeploy session leak

CISO Take

LMDeploy through 0.17.0, when run in DistServe prefill/decode disaggregation mode, never releases scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Any unauthenticated attacker who can reach the proxy endpoint can send ordinary completion requests until metadata and memory pile up and the prefill worker is OOM-killed, taking down LLM inference (CVSS 7.5, availability only; no confidentiality or integrity impact). Likelihood of exploitation is currently moderate to low: EPSS is 0.66% (top 50%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says TRACK*. Exploitation needs no skill, though, and the attack traffic looks like normal inference calls, so any internet-exposed or flat-network DistServe deployment is an easy target. Check whether you run DistServe mode, restrict proxy access behind authentication and rate limiting, monitor prefill worker memory, and track upstream issue #4967 for a fixed release since no patched version is confirmed in the data.

Sources:NVDEPSSATLASCISA SSVCVulnCheck advisoryGitHub (InternLM/lmdeploy)

What is the risk?

Medium-high for affected deployments, low for the general population. The vulnerability is network-reachable, needs no authentication, no privileges and no user interaction, and has low complexity (CVSS 7.5, A:H). Exposure is limited to DistServe prefill/decode disaggregation setups, which are a niche but growing pattern in large-scale LLM serving. Exploitation likelihood data is modest (EPSS 0.00658, not in KEV, no public exploit, no scanner template, SSVC TRACK*). Impact is limited to availability, but a repeatable OOM kill of the prefill worker can cause sustained outage of inference services. Dependent and downstream counts are unknown, so blast radius cannot be quantified.

How does the attack unfold?

Initial Access

Attacker reaches the unauthenticated DistServe proxy completion endpoint over the network.

AML.T0049

Exploitation

Repeated completion requests create scheduler sessions that the proxy never releases because it uses user-facing session IDs instead of internal keys.

AML.T0040

Resource Exhaustion

Unreleased scheduler metadata and memory accumulate on the prefill worker.

AML.T0029

Impact

The prefill worker is OOM-killed and LLM inference becomes unavailable until restart, and the attack can be repeated.

AML.T0029

Initial Access

Attacker reaches the unauthenticated DistServe proxy completion endpoint over the network.

AML.T0049

Exploitation

Repeated completion requests create scheduler sessions that the proxy never releases because it uses user-facing session IDs instead of internal keys.

AML.T0040

Resource Exhaustion

Unreleased scheduler metadata and memory accumulate on the prefill worker.

AML.T0029

Impact

The prefill worker is OOM-killed and LLM inference becomes unavailable until restart, and the attack can be repeated.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LMDeploy	pip	—	No patch
8.1K1 dependentsPushed 6d ago46% patched~18d to patchFull package profile →

Do you use LMDeploy? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Identify LMDeploy deployments (pip package lmdeploy) at version 0.17.0 or earlier that use DistServe/PD disaggregation. 2) Upgrade to a release that fixes the session ID handling once available; monitor GitHub issue #4967 and the project's releases, as the data does not confirm a patched version. 3) Until then, do not expose the DistServe proxy to untrusted networks; place it behind an API gateway or reverse proxy that enforces authentication, per-client rate limits and request quotas. 4) Set container or cgroup memory limits and automatic restarts for prefill workers, and consider scheduled worker recycling as a stopgap. 5) Detection: alert on steadily growing prefill worker memory without matching traffic growth, OOM-kill events, repeated worker restarts, and spikes of completion requests from a single source to the proxy. 6) Consider moving to non-disaggregated serving mode if DistServe is not essential.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceFrameworkAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and system failures

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-92983?

LMDeploy through 0.17.0, when run in DistServe prefill/decode disaggregation mode, never releases scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Any unauthenticated attacker who can reach the proxy endpoint can send ordinary completion requests until metadata and memory pile up and the prefill worker is OOM-killed, taking down LLM inference (CVSS 7.5, availability only; no confidentiality or integrity impact). Likelihood of exploitation is currently moderate to low: EPSS is 0.66% (top 50%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says TRACK*. Exploitation needs no skill, though, and the attack traffic looks like normal inference calls, so any internet-exposed or flat-network DistServe deployment is an easy target. Check whether you run DistServe mode, restrict proxy access behind authentication and rate limiting, monitor prefill worker memory, and track upstream issue #4967 for a fixed release since no patched version is confirmed in the data.

Is CVE-2026-92983 actively exploited?

No confirmed active exploitation of CVE-2026-92983 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-92983?

1) Identify LMDeploy deployments (pip package lmdeploy) at version 0.17.0 or earlier that use DistServe/PD disaggregation. 2) Upgrade to a release that fixes the session ID handling once available; monitor GitHub issue #4967 and the project's releases, as the data does not confirm a patched version. 3) Until then, do not expose the DistServe proxy to untrusted networks; place it behind an API gateway or reverse proxy that enforces authentication, per-client rate limits and request quotas. 4) Set container or cgroup memory limits and automatic restarts for prefill workers, and consider scheduled worker recycling as a stopgap. 5) Detection: alert on steadily growing prefill worker memory without matching traffic growth, OOM-kill events, repeated worker restarts, and spikes of completion requests from a single source to the proxy. 6) Consider moving to non-disaggregated serving mode if DistServe is not essential.

What systems are affected by CVE-2026-92983?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference clusters, prefill/decode disaggregated serving.

What is the CVSS score for CVE-2026-92983?

CVE-2026-92983 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference clustersprefill/decode disaggregated serving

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate unreleased scheduler metadata and memory until the prefill worker is out-of-memory killed.

Exploitation Scenario

An attacker discovers an exposed LMDeploy DistServe proxy through internet scanning or from a leaked internal endpoint list. Without credentials, they send a steady stream of small completion requests to the proxy. Each request creates a scheduler session on the prefill worker that is never released, because the proxy tries to free it using the user-facing session ID rather than the internal scheduler key. Memory grows with every request until the kernel OOM-kills the prefill worker, and the inference service goes down. The attacker repeats the process after each restart to keep the service unavailable.

Weaknesses (CWE)

CWE-772Missing Release of Resource after Effective LifetimePrimary CWE-772Missing Release of Resource after Effective Lifetime

CWE-772 — Missing Release of Resource after Effective Lifetime: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
[Implementation] It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including error conditions.

Source: MITRE CWE corpus.