Is CVE-2026-111160 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111160?

CVE-2026-111160 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-111160

Description

LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.