Unauthenticated attackers can exploit this behavior by flooding the proxy endpoint with specifically crafted completion requests. Because the system fails to clean up these sessions, they accumulate indefinitely, leading to a rapid consumption of scheduler metadata and system memory. This resource exhaustion eventually forces the prefill worker process into an out-of-memory (OOM) killed state, effectively causing a persistent denial of service. The vulnerability is critical for environments where LMDeploy is exposed to public or untrusted network segments, as it requires no authentication to initiate the exploit.

Impact

Successful exploitation results in the unavailability of the affected LLM inference service. In a production environment using DistServe, the termination of the prefill worker halts the processing of all incoming inference requests. Organizations relying on LMDeploy for automated AI workloads will face service disruption, requiring a manual restart of the worker nodes and potential remediation of the underlying memory leak by upgrading or patching the LMDeploy configuration.

Recommendation

Prioritize the identification of internet-facing LMDeploy instances and verify their version. Upgrade to a version of LMDeploy that resolves the session management flaw in DistServe mode. If an immediate upgrade is not feasible, restrict access to the LMDeploy proxy endpoint using network-layer controls, such as IP allowlisting or authentication proxies, to prevent unauthenticated access by external entities. Monitor resource utilization metrics on worker nodes for unexpected spikes in memory usage linked to the proxy service.