Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2025-66455: LMDeploy can run attacker code via crafted request
CVE-2025-66455 · published 24 days ago
Summary
Versions of LMDeploy between 0.9.2 and 0.16.0 let an unauthenticated user send a specially crafted message that causes the server to execute any code it wants. This happens when the DistServe feature is used without API‑key protection and the server can reach the attacker’s network address. Upgrade to version 0.16.0, block external access to the /distserve/* endpoints, limit network traffic to trusted machines, and enable API‑key authentication or stop outbound ZeroMQ connections until you can upgrade.
What to do
- Update openmmlab lmdeploy to version 0.16.0.
- Update lmdeploy to version 0.16.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | internlm | lmdeploy | >= 0.9.2, < 0.16.0 |
| pip | openmmlab | lmdeploy |
>= 0.9.2, < 0.16.0 Fix: upgrade to 0.16.0
|
| pip | – | lmdeploy |
>= 0.9.2, < 0.16.0 Fix: upgrade to 0.16.0
|
Original advisory text
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used by the receiver was supplied through the `POST /distserve/p2p_connect` HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key authentication is not enabled unless the operator explicitly configures it. As a result, affected DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should prevent untrusted clients from reaching `/distserve/*` endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle deserialization safe.
References
- https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2
- https://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd992...
- https://github.com/advisories/GHSA-2vh9-42vm-xmv2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66455... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-66455 Vendor Advisory
- https://github.com/InternLM/lmdeploy Product
- https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0
- https://pypi.org/project/lmdeploy Product
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published18 Sep 2026
Updated11 Oct 2026
First seen18 Sep 2026
Sources
CVE-2025-66455 · NVD
CVE-2025-66455 · MITRE
GHSA-2vh9-42vm-xmv2 · GHSA
CVE-2025-66455 · OSV
GHSA-2vh9-42vm-xmv2 · OSV
PYSEC-2026-4077 · OSV
Track software like this
Free during beta