CVE-2026-103042: Modeltc Lightllm

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposed_set_value method to store unbounded key-value pairs without size limits, causing the worker process to crash and triggering node failure.

Affected products

• Modeltc Lightllm: up to and including 1.2.0

Published 2026-09-29. Last modified 2026-10-02.