CVE-2026-103042

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1

Description A memory exhaustion issue exists in the NCCL control channel when the software is started with the --pd trans mode nccl configuration. Unauthenticated attackers can exploit this by calling the exposed set value() method to store an unlimited number of key-value pairs without size restrictions. This action exhausts the memory of the KV-transfer worker, leading to a process crash and subsequent node failure.

Recommendations Update LightLLM to version 1.2.1 or later. As a temporary mitigation, avoid starting the software with the --pd trans mode nccl flag.