Approved changes feed: RSS · Atom
cpe:2.3:a:sglang:sglang:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Sglang (794d6210-92bc-5a75-b4b3-2f4d05d5b235) |
|---|---|
| Product | Sglang (4ebfae41-8422-5cfa-bed9-dc0221b95bb5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-93088 |
vulnerable | 2026-10-13 12:28:55.999406 |
CVE-2026-93088
SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.
Published: 2026-09-22T14:07:45.629Z
Updated: 2026-09-22T18:45:48.365Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-94570 |
vulnerable | 2026-10-13 12:28:38.782586 |
CVE-2026-94570
SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.
Published: 2026-09-22T14:15:00.885Z
Updated: 2026-09-22T14:56:04.582Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15977 |
vulnerable | 2026-09-16 04:33:06.839732 |
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.
Published: 2026-07-30T18:07:54.911Z
Updated: 2026-07-31T19:08:46.654Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15976 |
vulnerable | 2026-09-16 04:33:06.731529 |
CVE-2026-15976
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.
Published: 2026-07-30T18:07:44.256Z
Updated: 2026-07-31T19:11:57.388Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15974 |
vulnerable | 2026-09-16 04:33:06.507998 |
CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.
Published: 2026-07-30T18:07:35.029Z
Updated: 2026-07-31T19:25:43.419Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15978 |
vulnerable | 2026-09-16 04:33:06.373419 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15971 |
vulnerable | 2026-09-16 04:33:06.216029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15969 |
vulnerable | 2026-09-16 04:33:06.200245 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86793 |
vulnerable | 2026-09-16 04:32:58.840694 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14890 |
vulnerable | 2026-07-29 00:26:17.634513 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7304 |
vulnerable | 2026-06-08 08:08:56.818606 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7302 |
vulnerable | 2026-06-08 08:08:56.815597 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7301 |
vulnerable | 2026-06-08 08:08:56.813806 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5760 |
vulnerable | 2026-06-08 08:07:04.067117 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3989 |
vulnerable | 2026-06-08 08:01:19.753730 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3060 |
vulnerable | 2026-06-08 08:01:17.664984 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3059 |
vulnerable | 2026-06-08 08:01:17.662553 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10300 |
vulnerable | 2026-06-08 07:47:13.801892 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.