InternLM LMDeploy vulnerabilities
15 published CVEs name InternLM LMDeploy among the affected products.
- 15Published CVEs15 of them scored
- 13Last 12 monthspublished in the last year
- 4Critical9 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-123818
LMDeploy URL parser disagreement permits SSRF filter bypass
InternLM · lmdeploy
High7.5 - CVE-2026-119706
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
InternLM · lmdeploy
Critical9.3 - CVE-2026-33625
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
InternLM · lmdeploy
High8.8 - CVE-2025-66455
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
InternLM · lmdeploy
Critical9.8 - CVE-2026-92983
InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch
InternLM · lmdeploy
High8.7 - CVE-2026-92971
InternLM LMDeploy through 0.17.0 Assertion Denial of Service
InternLM · lmdeploy
High8.7 - CVE-2025-59953
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
InternLM · lmdeploy
Critical9.8 - CVE-2026-76850
LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector
InternLM · lmdeploy
Critical9.3 - CVE-2026-63764
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
InternLM · lmdeploy
High7.7 - CVE-2026-46517
LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
InternLM · lmdeploy
High7.8