Cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*

InternLM LMDeploy versions 0.9.0 through 0.18.0 are vulnerable to unauthenticated remote code execution via insecure deserialization of pickled data.

InternLM LMDeploy version 0.17.0 and earlier is vulnerable to a denial-of-service attack due to improper session management in DistServe mode, allowing unauthenticated attackers to cause an out-of-memory failure on the prefill worker.