CVE-2026-103042Published

LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-103042 · Microsoft / collected KEV context

cve-program · CVE-2026-103042

https://github.com/ModelTC/LightLLM/issues/1595
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L416-L420
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L474-L485
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/base_kv_move_manager.py#L121-L122
https://github.com/ModelTC/LightLLM
https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-memory-exhaustion-via-nccl-control-channel-set-value

Related operational evidence

Explicit CVE identifiers

No related operational record is retained in the current change model.