CVE-2026-63764

{"id": "CVE-2026-63764", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63764", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T14:12:09.324972Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/InternLM/lmdeploy", "vendor": "InternLM", "product": "lmdeploy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.14.0"}, {"status": "unaffected", "version": "03c313006d17cc3feae86b633c44206a997c44db", "versionType": "git"}], "packageURL": "pkg:pypi/lmdeploy", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T21:16:53.350", "references": [{"url": "https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997c44db", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/InternLM/lmdeploy/issues/4761", "tags": ["Exploit", "Issue Tracking", "Mitigation"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/InternLM/lmdeploy/pull/4734", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/lmdeploy-server-side-request-forgery-via-http-redirect-bypass", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/InternLM/lmdeploy/issues/4761", "tags": ["Exploit", "Issue Tracking", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline."}, {"lang": "es", "value": "LMDeploy hasta la versi\u00f3n 0.14.0, corregido en el commit 03c3130, contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en la funci\u00f3n _load_http_url dentro del gestor de medios connection.py, donde la protecci\u00f3n de IP privada valida solo la URL original sin revalidar los hosts despu\u00e9s de las redirecciones HTTP. Un atacante no autenticado puede enviar una image_url manipulada al endpoint de finalizaci\u00f3n de chat apuntando a un host controlado por el atacante que devuelve una redirecci\u00f3n a una IP privada o a un endpoint de metadatos de la nube, haciendo que el servidor siga la redirecci\u00f3n y exponga contenido de servicio interno a trav\u00e9s de la pipeline del modelo."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D6EA536-0BEC-4D30-9C54-6095241EA09D", "versionEndIncluding": "0.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}