CVE-2026-103042 [HIGH] – LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control chan

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with –pd_trans_mode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposed_set_value method to store unbounded key-value pairs without size limits, causing the worker process to crash and triggering node failure.