CVE-2025-66455
CriticalCVSS 9.8Summary
LMDeploy versions 0.9.2 through 0.16.0 used recv_pyobj() to deserialize messages received over a ZeroMQ PULL socket in the DistServe/PD-disaggregation control plane. PyZMQ implements recv_pyobj() with Python pickle deserialization, which can execute arbitrary code, and the peer address was supplied via the POST /distserve/p2p_connect HTTP endpoint. Without API-key authentication enabled, an attacker could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload, leading to unauthenticated remote code execution.
Risk Assessment
The vulnerability allows an unauthenticated attacker with network access to an affected DistServe API server to achieve remote code execution with the privileges of the LMDeploy serving process. This affects only deployments using the PyTorch backend with PD-disaggregation/DistServe enabled, particularly those without API-key authentication configured.
Recommendation
Upgrade LMDeploy to version 0.16.0 or later. If immediate upgrade is not possible, prevent untrusted clients from reaching /distserve/* endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes.
Other vulnerabilities in LMDeploy
See all- CVE-2026-33625High
LMDeploy versions 0.12.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620. An attacker can execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization_config.quant_dtype value, which is passed to eval() without validation.
- CVE-2025-59953Critical
LMDeploy implements an RPC server (AsyncRPCServer in zmq_rpc.py) whose call_and_response() function deserializes received messages using pickles.loads() without any sanitization. This allows remote code execution through the RPC server. The vulnerability exists from version 0.9.1 up to 0.10.2, where it is patched.
- CVE-2026-76850Critical
LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.
- CVE-2026-92983High
InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate unreleased scheduler metadata and memory until the prefill worker is out-of-memory killed.
- CVE-2026-63764High
SSRF vulnerability in LMDeploy up to version 0.14.0 (fixed in commit 03c3130) in the _load_http_url function in connection.py. The private-IP guard only validates the original URL without re-validating hosts after HTTP redirects.
- CVE-2026-46517High
LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.
- CVE-2026-46432High
LMDeploy versions up to 0.12.3 have hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites, allowing arbitrary code execution. No public patches are available at the time of publication.
Original NVD description (English source)
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used by the receiver was supplied through the `POST /distserve/p2p_connect` HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should prevent untrusted clients from reaching `/distserve/*` endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe.