CVE-2026-111160

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1

Description An unauthenticated attacker can cause a denial of service by sending a request to the '/generate' endpoint containing the pd kv trans params field. This triggers a failure in the pickle.loads function within InferSamplingParams, which crashes the inference thread. While the '/health' endpoint remains operational, all subsequent requests will hang until the system is restarted.

Recommendations Update LightLLM to a version later than 1.2.0. Avoid using the pd kv trans params parameter in the '/generate' endpoint until the update is applied.