Database/AI/ML frameworks & serving
LightLLM: unbounded key-value writes on the NCCL control channel exhaust worker memory
Impact
When LightLLM runs with --pd_trans_mode nccl, the KV-transfer worker exposes an RPC method exposed_set_value that stores caller-supplied key-value pairs with no size or count limit. An unauthenticated caller can grow that store until the worker process dies of memory exhaustion, which takes the node's serving role down with it. On a GPU node this is expensive: the process holds model weights and KV cache, so a restart means reloading weights and losing warm cache, and in a multi-node disaggregated setup the peer waiting on that transfer fails too.
Who can reach it
Anyone with network reach to the LightLLM KV-transfer control channel. No authentication is described on that channel, so exposure depends entirely on whether the port is confined to the internal fabric.
What to do
No fixed version is published in the record; the issue is tracked as ModelTC/LightLLM#1595 and reported through 1.2.0. Until a fix lands, bind the KV-transfer control channel to the internal fabric only, never to a tenant-reachable network, and cap worker memory so the OOM is contained. Recovery is restarting the affected worker process.
References
Related entries
- Mooncake transfer engine: zero-length handshake frame crashes the hosting inference processCVE-2026-104433 · Mooncake transfer engine (P2P handshake readString)High
- Katanemo Plano: unauthenticated Envoy admin interface leaks LLM provider API keysCVE-2026-108863 · Katanemo Plano (embedded Envoy admin interface on port 9901)High
- SGLang: oversized audio uploads are buffered in memory, crashing the HTTP/tokenizer workerCVE-2026-109225 · SGLang HTTP server (/v1/audio/transcriptions multipart upload)High
- SGLang: compressed audio decodes without duration limits, exhausting worker memory and CPUCVE-2026-109226 · SGLang load_audio (audio_url / audio_data decoding, no duration or sample limit)High
- SGLang: full-resolution video decode before max_pixels clamp exhausts inference worker memoryCVE-2026-109227 · SGLang (Qwen-VL video preprocessing, preprocess_video in qwen_vl.py)High
- SGLang: client can override GLM-V video decode budget via video_url fields and exhaust worker memoryCVE-2026-109228 · SGLang (GLM-V video processing, client-supplied fps/max_frames limits in glm4v.py)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.