Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 23

Export CSV
CVE-2026-111392

SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-111391

SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter

SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-112268

sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-112267

SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-112269

SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncake_session_id values and large nested-buffer frames to exhaust Prefill memory until the scheduler is OOM-killed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-112266

SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering prefix-matching abort logic that terminates all other clients' requests.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-112270

SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGING_RSP messages with huge chunk_idx values under fresh room IDs, causing the scheduler to be OOM-killed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-112083

sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service

A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-112082

sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-109227

SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-110809

sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-110807

sgl-project SGLang generate Endpoint io_struct.py denial of service

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-109228

SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-109226

SGLang through 0.5.21 Audio Decompression Amplification via load_audio

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-109225

SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-109229

SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-105245

sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of the component HTTP Endpoint. Such manipulation of the argument api_key leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-93688

SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-93838

SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Lmsys Sgl-project
Products
Sglang Sglang
CVE-2026-92972

SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang