CVE-2026-63764

Katalog CVE

CVSS 8.6 · High EPSS 0,51%

Kerentanan Server-Side Request Forgery (SSRF) pada internlm lmdeploy. Skor CVSS 3.1 8.6 (High) menurut vulncheck.com.

Deskripsi (NVD)

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

17 September 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997c44db patch
• https://github.com/InternLM/lmdeploy/pull/4734 issue tracking · patch
• https://www.vulncheck.com/advisories/lmdeploy-server-side-request-forgery-via-http-redirect-bypass exploit · patch · advisory pihak ketiga
• https://github.com/InternLM/lmdeploy/issues/4761 exploit · issue tracking · mitigasi