CVE-2026-103042
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
ModelTC LightLLM
CVSS
8.7HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 2 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposed_set_value method to store unbounded key-value pairs without size limits, causing the worker process to crash and triggering node failure.
Text from CVE List
Affected versions 1
- LightLLMaffected: all versions through 1.2.0CVE List
References 6
- vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-memory-exhaustion-via-nccl-control-channel-set-valueAdvisoryvia CVE List
- github.com/ModelTC/LightLLM/issues/1595Exploitvia CVE List
- github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L416-L420Referencevia CVE List
- github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L474-L485Referencevia CVE List
- github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/base_kv_move_manager.py#L121-L122Referencevia CVE List
- github.com/ModelTC/LightLLMReferencevia CVE List