CVE-2025-66455

CVE-2025-66455 is a critical-severity insecure deserialization vulnerability in lmdeploy (pip), affecting versions >= 0.9.2, < 0.16.0. It is fixed in 0.16.0.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

LMDeploy has Remote Code Execution by Pickle Deserialization via handlezmqrecv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

LMDeploy's PyTorch DistServe/PD-disaggregation control plane used
recv_pyobj() to deserialize messages received through a ZeroMQ PULL
socket. PyZMQ implements recv_pyobj() using Python pickle
deserialization, which can execute arbitrary code while reconstructing
an object.

The peer address used by the receiver was supplied through the
POST /distserve/p2p_connect HTTP endpoint. An attacker who could reach
an affected DistServe API server could cause the server to connect to an
attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle
payload.

API-key authentication is not enabled unless the operator explicitly
configures it. As a result, affected DistServe deployments without API
keys allowed unauthenticated remote code execution with the privileges
of the LMDeploy serving process.

This issue affects the PyTorch backend when PD-disaggregation/DistServe
is enabled. Ordinary deployments that do not use the affected
disaggregated-serving path do not expose this data flow.

Affected components

  • HTTP entry point:
    lmdeploy/serve/openai/endpoints/distserve.py,
    POST /distserve/p2p_connect
  • Attacker-controlled peer address:
    DistServeConnectionRequest.remote_engine_endpoint_info.zmq_address
  • Vulnerable receiver:
    lmdeploy/pytorch/disagg/conn/engine_conn.py,
    EngineP2PConnection.handle_zmq_recv()
  • Unsafe operation: recv_pyobj(), which performs pickle deserialization

Vulnerable data flow

  1. A caller submits a DistServe P2P connection request containing a
    ZeroMQ address.
  2. The LMDeploy engine connects its ZeroMQ PULL socket to that address.
  3. handle_zmq_recv() receives messages using recv_pyobj().
  4. A malicious peer sends a crafted pickle object.
  5. Python code executes during deserialization, before LMDeploy can
    perform any type or field validation.

A type check performed after recv_pyobj() cannot mitigate this issue
because pickle payload execution occurs during deserialization.

Affected versions

Affected versions:

  • lmdeploy >= 0.9.2, < 0.16.0

The vulnerable P2P receiver was introduced in commit b0b705f7.

Workarounds

Users who cannot upgrade immediately should:

  • Prevent untrusted clients from reaching /distserve/* endpoints.
  • Restrict the DistServe HTTP and ZeroMQ control planes to trusted
    cluster networks.
  • Configure API-key authentication.
  • Block arbitrary outbound ZeroMQ connections from serving nodes.

These measures reduce exposure but do not make pickle deserialization
safe. Upgrading to LMDeploy 0.16.0 or later is recommended.

Impact

Successful exploitation allows arbitrary code execution as the
LMDeploy serving process. This can expose model weights, prompts,
credentials, attached storage, cluster-network services, and host or
GPU resources. An attacker may also modify or terminate the serving
process.

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

CVE-2025-66455 has a CVSS score of 9.8 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.16.0); upgrading removes the vulnerable code path.

Affected versions

lmdeploy (>= 0.9.2, < 0.16.0)

Security releases

lmdeploy → 0.16.0 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

The issue was fixed by replacing the pickle-based ZeroMQ protocol with
JSON serialization:

  • send_pyobj() was replaced with send_json().
  • recv_pyobj() was replaced with recv_json().
  • Received objects are validated using the
    DistServeCacheFreeRequest Pydantic schema before use.
  • Invalid or off-schema messages are rejected without terminating the
    receive loop.

Fix commit:

https://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd99223b2

The fix was released in LMDeploy 0.16.0.

Frequently Asked Questions

  1. What is CVE-2025-66455? CVE-2025-66455 is a critical-severity insecure deserialization vulnerability in lmdeploy (pip), affecting versions >= 0.9.2, < 0.16.0. It is fixed in 0.16.0. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
  2. How severe is CVE-2025-66455? CVE-2025-66455 has a CVSS score of 9.8 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
  3. Which versions of lmdeploy are affected by CVE-2025-66455? lmdeploy (pip) versions >= 0.9.2, < 0.16.0 is affected.
  4. Is there a fix for CVE-2025-66455? Yes. CVE-2025-66455 is fixed in 0.16.0. Upgrade to this version or later.
  5. Is CVE-2025-66455 exploitable, and should I be worried? Whether CVE-2025-66455 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  6. What actually determines whether CVE-2025-66455 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  7. How do I fix CVE-2025-66455? Upgrade lmdeploy to 0.16.0 or later.

Other vulnerabilities in lmdeploy

CVE-IDSeverityPackage summary
GHSA-39WR-7Q6H-CF68Highlmdeploy: LMDeploy has an SSRF bypassCVE-2026-33625Highlmdeploy: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingCVE-2025-59953Criticallmdeploy: LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeployCVE-2026-46517Highlmdeploy: lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outCVE-2026-46432Highlmdeploy: LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo