Detections
Analytics

SCA: security update for lmdeploy (GHSA-2vh9-42vm-xmv2)

critical Tenable Self-Hosted Container Security Plugin ID 448256

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version
 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used
 `recv_pyobj()` to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements
 `recv_pyobj()` using Python pickle deserialization, which can execute arbitrary code while reconstructing
 an object. The peer address used by the receiver was supplied through the `POST /distserve/p2p_connect`
 HTTP endpoint. An attacker who could reach an affected DistServe API server could cause the server to
 connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload. API-key
 authentication is not enabled unless the operator explicitly configures it. As a result, affected
 DistServe deployments without API keys allowed unauthenticated remote code execution with the privileges
 of the LMDeploy serving process. This issue affects the PyTorch backend when PD-disaggregation/DistServe
 is enabled. Ordinary deployments that do not use the affected disaggregated-serving path do not expose
 this data flow. The fix was released in LMDeploy 0.16.0. Users who cannot upgrade immediately should
 prevent untrusted clients from reaching `/distserve/*` endpoints, restrict the DistServe HTTP and ZeroMQ
 control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound
 ZeroMQ connections from serving nodes. These measures reduce exposure but do not make pickle
 deserialization safe. (CVE-2025-66455)

Solution

Update the lmdeploy library and its related packages to version 0.16.0 or later.

See Also

https://github.com/advisories/GHSA-2vh9-42vm-xmv2

Plugin Details

Severity: Critical

ID: 448256

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/23/2026

Updated: 9/23/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.27

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-66455

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/18/2026

Vulnerability Publication Date: 9/18/2026

Reference Information

CVE: CVE-2025-66455

cwe: CWE-502