Search
Find a vulnerability
Search criteria
10 vulnerabilities found for sglang by sgl-project
CVE-2026-93838 (GCVE-0-2026-93838)
Vulnerability from nvd – Published: 2026-09-18 19:06 – Updated: 2026-09-18 20:09
VLAI
EPSS
VEX
Title
SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx
Summary
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:09 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/sgl-project/sglang/issues/39764 | issue-tracking |
| https://github.com/sgl-project/sglang | product |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://www.vulncheck.com/advisories/sglang-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | sglang |
Affected:
0 , ≤ 0.5.20
(semver)
cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:* |
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93838",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:09:38.130553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:09:44.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sgl-project/sglang/issues/39764"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/sglang",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/sglang",
"product": "sglang",
"repo": "https://github.com/sgl-project/sglang",
"vendor": "sgl-project",
"versions": [
{
"lessThanOrEqual": "0.5.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jiapeng Li"
},
{
"lang": "en",
"type": "reporter",
"value": "Mingkai Yu"
},
{
"lang": "en",
"type": "reporter",
"value": "Jiajia Liu"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine\u0027s internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:06:03.899Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #39764",
"tags": [
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/39764"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/staging_handler.py#L781"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/staging_handler.py#L848-L860"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/conn.py#L1636-L1640"
},
{
"name": "VulnCheck Advisory: SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.20-unbounded-memory-allocation-via-staging-req-chunk-idx"
}
],
"title": "SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93838",
"datePublished": "2026-09-18T19:06:03.899Z",
"dateReserved": "2026-09-18T18:16:36.587Z",
"dateUpdated": "2026-09-18T20:09:44.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93688 (GCVE-0-2026-93688)
Vulnerability from nvd – Published: 2026-09-18 15:06 – Updated: 2026-09-18 16:23
VLAI
EPSS
VEX
Title
SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room
Summary
SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/sgl-project/sglang/issues/39428 | issue-tracking |
| https://github.com/sgl-project/sglang | product |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://www.vulncheck.com/advisories/sglang-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | sglang |
Affected:
0 , ≤ 0.5.19
(semver)
cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:* |
Date Public
2026-09-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/sglang",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/sglang",
"product": "sglang",
"repo": "https://github.com/sgl-project/sglang",
"vendor": "sgl-project",
"versions": [
{
"lessThanOrEqual": "0.5.19",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.19",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jiapeng Li"
},
{
"lang": "en",
"type": "finder",
"value": "Mingkai Yu"
},
{
"lang": "en",
"type": "finder",
"value": "Jiajia Liu"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine\u0027s POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:23:59.301Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #39428",
"tags": [
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/39428"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/mooncake/conn.py#L2118-L2119"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/mooncake/conn.py#L1988-L1990"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/managers/io_struct.py#L281"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/managers/scheduler.py#L2672-L2690"
},
{
"name": "VulnCheck Advisory: SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.19-unbounded-memory-allocation-via-bootstrap-room"
}
],
"title": "SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93688",
"datePublished": "2026-09-18T15:06:03.530Z",
"dateReserved": "2026-09-18T14:39:01.470Z",
"dateUpdated": "2026-09-18T16:23:59.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92972 (GCVE-0-2026-92972)
Vulnerability from nvd – Published: 2026-09-17 13:43 – Updated: 2026-09-18 16:23
VLAI
EPSS
VEX
Title
SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
Summary
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:15 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sgl-project/sglang/issues/39400 | issue-tracking |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang | product |
| https://www.vulncheck.com/advisories/sglang-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | sglang |
Affected:
0 , ≤ 0.5.19
(semver)
|
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92972",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:15:50.626497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:21:12.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/sglang",
"product": "sglang",
"vendor": "sgl-project",
"versions": [
{
"lessThanOrEqual": "0.5.19",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jiapeng Li"
},
{
"lang": "en",
"type": "finder",
"value": "Mingkai Yu"
},
{
"lang": "en",
"type": "finder",
"value": "Jiajia Liu"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:23:32.042Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #39400",
"tags": [
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/39400"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/common/conn.py#L1736-L1810"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/common/conn.py#L1716-L1718"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang"
},
{
"name": "VulnCheck Advisory: SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.19-unauthenticated-route-poisoning-via-put-endpoint"
}
],
"title": "SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92972",
"datePublished": "2026-09-17T13:43:16.670Z",
"dateReserved": "2026-09-17T13:23:59.248Z",
"dateUpdated": "2026-09-18T16:23:32.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10775 (GCVE-0-2026-10775)
Vulnerability from nvd – Published: 2026-06-03 22:15 – Updated: 2026-06-04 13:38
VLAI
EPSS
VEX
Title
sgl-project SGLang Cache data_hash denial of service
Summary
A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-04 13:35 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368138 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/368138/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10775 | third-party-advisory |
| https://vuldb.com/submit/831438 | third-party-advisory |
| https://github.com/sgl-project/sglang/issues/25462 | exploitissue-tracking |
| https://github.com/sgl-project/sglang/pull/22033 | issue-trackingpatch |
| https://github.com/sgl-project/sglang/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | SGLang |
Affected:
0.5.0
Affected: 0.5.1 Affected: 0.5.2 Affected: 0.5.3 Affected: 0.5.4 Affected: 0.5.5 Affected: 0.5.6 Affected: 0.5.7 Affected: 0.5.8 Affected: 0.5.9 Affected: 0.5.10 Affected: 0.5.11 cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10775",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:35:58.281057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:38:02.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/831438"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/sgl-project/sglang/pull/22033"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*"
],
"modules": [
"Cache Handler"
],
"product": "SGLang",
"vendor": "sgl-project",
"versions": [
{
"status": "affected",
"version": "0.5.0"
},
{
"status": "affected",
"version": "0.5.1"
},
{
"status": "affected",
"version": "0.5.2"
},
{
"status": "affected",
"version": "0.5.3"
},
{
"status": "affected",
"version": "0.5.4"
},
{
"status": "affected",
"version": "0.5.5"
},
{
"status": "affected",
"version": "0.5.6"
},
{
"status": "affected",
"version": "0.5.7"
},
{
"status": "affected",
"version": "0.5.8"
},
{
"status": "affected",
"version": "0.5.9"
},
{
"status": "affected",
"version": "0.5.10"
},
{
"status": "affected",
"version": "0.5.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.4,
"vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T22:15:10.154Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368138 | sgl-project SGLang Cache data_hash denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/368138"
},
{
"name": "VDB-368138 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368138/cti"
},
{
"name": "CVE-2026-10775 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10775"
},
{
"name": "Submit #831438 | sgl-project/ sglang 0.5.11 Cache Poisoning",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/831438"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/25462"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/sgl-project/sglang/pull/22033"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-03T17:51:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "sgl-project SGLang Cache data_hash denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10775",
"datePublished": "2026-06-03T22:15:10.154Z",
"dateReserved": "2026-06-03T15:46:16.282Z",
"dateUpdated": "2026-06-04T13:38:02.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7669 (GCVE-0-2026-7669)
Vulnerability from nvd – Published: 2026-05-02 22:00 – Updated: 2026-05-05 00:31
VLAI
EPSS
VEX
Title
sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection
Summary
A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode="auto" and tokenizer_mode="slow" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-05 00:31 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/360817 | vdb-entrytechnical-descriptionexploit |
| https://vuldb.com/vuln/360817/cti | signaturepermissions-required |
| https://vuldb.com/submit/799263 | third-party-advisory |
| https://github.com/gouldnicholas/CVE-2026-7669-PoC | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | SGLang |
Affected:
0.5.0
Affected: 0.5.1 Affected: 0.5.2 Affected: 0.5.3 Affected: 0.5.4 Affected: 0.5.5 Affected: 0.5.6 Affected: 0.5.7 Affected: 0.5.8 Affected: 0.5.9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7669",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-05T00:31:25.310003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T00:31:40.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HuggingFace Transformer Handler"
],
"product": "SGLang",
"vendor": "sgl-project",
"versions": [
{
"status": "affected",
"version": "0.5.0"
},
{
"status": "affected",
"version": "0.5.1"
},
{
"status": "affected",
"version": "0.5.2"
},
{
"status": "affected",
"version": "0.5.3"
},
{
"status": "affected",
"version": "0.5.4"
},
{
"status": "affected",
"version": "0.5.5"
},
{
"status": "affected",
"version": "0.5.6"
},
{
"status": "affected",
"version": "0.5.7"
},
{
"status": "affected",
"version": "0.5.8"
},
{
"status": "affected",
"version": "0.5.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nicholas Gould"
},
{
"lang": "en",
"type": "finder",
"value": "David Rochester"
},
{
"lang": "en",
"type": "reporter",
"value": "ngould (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "ngould (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller\u0027s explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode=\"auto\" and tokenizer_mode=\"slow\" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.1,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T04:21:53.695Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-360817 | sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection",
"tags": [
"vdb-entry",
"technical-description",
"exploit"
],
"url": "https://vuldb.com/vuln/360817"
},
{
"name": "VDB-360817 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/360817/cti"
},
{
"name": "Submit #799263 | sgl-project sglang \u003c=0.5.9 Protection Mechanism Failure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/799263"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-07T02:00:00.000Z",
"value": "Vulnerability found"
},
{
"lang": "en",
"time": "2026-04-07T02:00:00.000Z",
"value": "Vendor informed"
},
{
"lang": "en",
"time": "2026-05-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-03T02:00:00.000Z",
"value": "Exploit disclosed"
},
{
"lang": "en",
"time": "2026-05-04T06:26:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-7669",
"datePublished": "2026-05-02T22:00:19.859Z",
"dateReserved": "2026-05-02T08:00:13.701Z",
"dateUpdated": "2026-05-05T00:31:40.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93838 (GCVE-0-2026-93838)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:06 – Updated: 2026-09-18 20:09
VLAI
EPSS
VEX
Title
SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx
Summary
SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:09 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/sgl-project/sglang/issues/39764 | issue-tracking |
| https://github.com/sgl-project/sglang | product |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://www.vulncheck.com/advisories/sglang-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | sglang |
Affected:
0 , ≤ 0.5.20
(semver)
cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:* |
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93838",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:09:38.130553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:09:44.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sgl-project/sglang/issues/39764"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/sglang",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/sglang",
"product": "sglang",
"repo": "https://github.com/sgl-project/sglang",
"vendor": "sgl-project",
"versions": [
{
"lessThanOrEqual": "0.5.20",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jiapeng Li"
},
{
"lang": "en",
"type": "reporter",
"value": "Mingkai Yu"
},
{
"lang": "en",
"type": "reporter",
"value": "Jiajia Liu"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine\u0027s internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:06:03.899Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #39764",
"tags": [
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/39764"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/staging_handler.py#L781"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/staging_handler.py#L848-L860"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/conn.py#L1636-L1640"
},
{
"name": "VulnCheck Advisory: SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.20-unbounded-memory-allocation-via-staging-req-chunk-idx"
}
],
"title": "SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93838",
"datePublished": "2026-09-18T19:06:03.899Z",
"dateReserved": "2026-09-18T18:16:36.587Z",
"dateUpdated": "2026-09-18T20:09:44.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93688 (GCVE-0-2026-93688)
Vulnerability from cvelistv5 – Published: 2026-09-18 15:06 – Updated: 2026-09-18 16:23
VLAI
EPSS
VEX
Title
SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room
Summary
SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/sgl-project/sglang/issues/39428 | issue-tracking |
| https://github.com/sgl-project/sglang | product |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://www.vulncheck.com/advisories/sglang-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | sglang |
Affected:
0 , ≤ 0.5.19
(semver)
cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:* |
Date Public
2026-09-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/sglang",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/sglang",
"product": "sglang",
"repo": "https://github.com/sgl-project/sglang",
"vendor": "sgl-project",
"versions": [
{
"lessThanOrEqual": "0.5.19",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.19",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jiapeng Li"
},
{
"lang": "en",
"type": "finder",
"value": "Mingkai Yu"
},
{
"lang": "en",
"type": "finder",
"value": "Jiajia Liu"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine\u0027s POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:23:59.301Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #39428",
"tags": [
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/39428"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/mooncake/conn.py#L2118-L2119"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/mooncake/conn.py#L1988-L1990"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/managers/io_struct.py#L281"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/managers/scheduler.py#L2672-L2690"
},
{
"name": "VulnCheck Advisory: SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.19-unbounded-memory-allocation-via-bootstrap-room"
}
],
"title": "SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93688",
"datePublished": "2026-09-18T15:06:03.530Z",
"dateReserved": "2026-09-18T14:39:01.470Z",
"dateUpdated": "2026-09-18T16:23:59.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92972 (GCVE-0-2026-92972)
Vulnerability from cvelistv5 – Published: 2026-09-17 13:43 – Updated: 2026-09-18 16:23
VLAI
EPSS
VEX
Title
SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
Summary
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:15 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sgl-project/sglang/issues/39400 | issue-tracking |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.1… | technical-description |
| https://github.com/sgl-project/sglang | product |
| https://www.vulncheck.com/advisories/sglang-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | sglang |
Affected:
0 , ≤ 0.5.19
(semver)
|
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92972",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:15:50.626497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:21:12.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/sglang",
"product": "sglang",
"vendor": "sgl-project",
"versions": [
{
"lessThanOrEqual": "0.5.19",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jiapeng Li"
},
{
"lang": "en",
"type": "finder",
"value": "Mingkai Yu"
},
{
"lang": "en",
"type": "finder",
"value": "Jiajia Liu"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:23:32.042Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #39400",
"tags": [
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/39400"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/common/conn.py#L1736-L1810"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/common/conn.py#L1716-L1718"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang"
},
{
"name": "VulnCheck Advisory: SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.19-unauthenticated-route-poisoning-via-put-endpoint"
}
],
"title": "SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92972",
"datePublished": "2026-09-17T13:43:16.670Z",
"dateReserved": "2026-09-17T13:23:59.248Z",
"dateUpdated": "2026-09-18T16:23:32.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10775 (GCVE-0-2026-10775)
Vulnerability from cvelistv5 – Published: 2026-06-03 22:15 – Updated: 2026-06-04 13:38
VLAI
EPSS
VEX
Title
sgl-project SGLang Cache data_hash denial of service
Summary
A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-04 13:35 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/368138 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/368138/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-10775 | third-party-advisory |
| https://vuldb.com/submit/831438 | third-party-advisory |
| https://github.com/sgl-project/sglang/issues/25462 | exploitissue-tracking |
| https://github.com/sgl-project/sglang/pull/22033 | issue-trackingpatch |
| https://github.com/sgl-project/sglang/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | SGLang |
Affected:
0.5.0
Affected: 0.5.1 Affected: 0.5.2 Affected: 0.5.3 Affected: 0.5.4 Affected: 0.5.5 Affected: 0.5.6 Affected: 0.5.7 Affected: 0.5.8 Affected: 0.5.9 Affected: 0.5.10 Affected: 0.5.11 cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10775",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-04T13:35:58.281057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-04T13:38:02.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/831438"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/sgl-project/sglang/pull/22033"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sgl-project:sglang:*:*:*:*:*:*:*:*"
],
"modules": [
"Cache Handler"
],
"product": "SGLang",
"vendor": "sgl-project",
"versions": [
{
"status": "affected",
"version": "0.5.0"
},
{
"status": "affected",
"version": "0.5.1"
},
{
"status": "affected",
"version": "0.5.2"
},
{
"status": "affected",
"version": "0.5.3"
},
{
"status": "affected",
"version": "0.5.4"
},
{
"status": "affected",
"version": "0.5.5"
},
{
"status": "affected",
"version": "0.5.6"
},
{
"status": "affected",
"version": "0.5.7"
},
{
"status": "affected",
"version": "0.5.8"
},
{
"status": "affected",
"version": "0.5.9"
},
{
"status": "affected",
"version": "0.5.10"
},
{
"status": "affected",
"version": "0.5.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is the function data_hash of the component Cache Handler. This manipulation causes denial of service. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.4,
"vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T22:15:10.154Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-368138 | sgl-project SGLang Cache data_hash denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/368138"
},
{
"name": "VDB-368138 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/368138/cti"
},
{
"name": "CVE-2026-10775 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10775"
},
{
"name": "Submit #831438 | sgl-project/ sglang 0.5.11 Cache Poisoning",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/831438"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/25462"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/sgl-project/sglang/pull/22033"
},
{
"tags": [
"product"
],
"url": "https://github.com/sgl-project/sglang/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-03T17:51:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "sgl-project SGLang Cache data_hash denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10775",
"datePublished": "2026-06-03T22:15:10.154Z",
"dateReserved": "2026-06-03T15:46:16.282Z",
"dateUpdated": "2026-06-04T13:38:02.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7669 (GCVE-0-2026-7669)
Vulnerability from cvelistv5 – Published: 2026-05-02 22:00 – Updated: 2026-05-05 00:31
VLAI
EPSS
VEX
Title
sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection
Summary
A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller's explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode="auto" and tokenizer_mode="slow" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-05 00:31 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/360817 | vdb-entrytechnical-descriptionexploit |
| https://vuldb.com/vuln/360817/cti | signaturepermissions-required |
| https://vuldb.com/submit/799263 | third-party-advisory |
| https://github.com/gouldnicholas/CVE-2026-7669-PoC | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | SGLang |
Affected:
0.5.0
Affected: 0.5.1 Affected: 0.5.2 Affected: 0.5.3 Affected: 0.5.4 Affected: 0.5.5 Affected: 0.5.6 Affected: 0.5.7 Affected: 0.5.8 Affected: 0.5.9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7669",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-05T00:31:25.310003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T00:31:40.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HuggingFace Transformer Handler"
],
"product": "SGLang",
"vendor": "sgl-project",
"versions": [
{
"status": "affected",
"version": "0.5.0"
},
{
"status": "affected",
"version": "0.5.1"
},
{
"status": "affected",
"version": "0.5.2"
},
{
"status": "affected",
"version": "0.5.3"
},
{
"status": "affected",
"version": "0.5.4"
},
{
"status": "affected",
"version": "0.5.5"
},
{
"status": "affected",
"version": "0.5.6"
},
{
"status": "affected",
"version": "0.5.7"
},
{
"status": "affected",
"version": "0.5.8"
},
{
"status": "affected",
"version": "0.5.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nicholas Gould"
},
{
"lang": "en",
"type": "finder",
"value": "David Rochester"
},
{
"lang": "en",
"type": "reporter",
"value": "ngould (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "ngould (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokenizer of the file python/sglang/srt/utils/hf_transformers_utils.py of the component HuggingFace Transformer Handler. The manipulation of the argument trust_remote_code with the input False as part of Boolean results in code injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. In get_tokenizer(), when the caller passes trust_remote_code=False and HuggingFace transformers v5 returns a TokenizersBackend instance (the generic fallback for tokenizer classes not in the registry), SGLang silently re-invokes AutoTokenizer.from_pretrained with trust_remote_code=True, overriding the caller\u0027s explicit security setting. A model repository containing a malicious tokenizer.py referenced via auto_map in tokenizer_config.json will execute arbitrary Python in the SGLang process during this second call. No log line or warning is emitted. The override affects all current SGLang versions because transformers==5.3.0 is pinned in pyproject.toml. Both tokenizer_mode=\"auto\" and tokenizer_mode=\"slow\" are affected. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.1,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T04:21:53.695Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-360817 | sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection",
"tags": [
"vdb-entry",
"technical-description",
"exploit"
],
"url": "https://vuldb.com/vuln/360817"
},
{
"name": "VDB-360817 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/360817/cti"
},
{
"name": "Submit #799263 | sgl-project sglang \u003c=0.5.9 Protection Mechanism Failure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/799263"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/gouldnicholas/CVE-2026-7669-PoC"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-07T02:00:00.000Z",
"value": "Vulnerability found"
},
{
"lang": "en",
"time": "2026-04-07T02:00:00.000Z",
"value": "Vendor informed"
},
{
"lang": "en",
"time": "2026-05-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-03T02:00:00.000Z",
"value": "Exploit disclosed"
},
{
"lang": "en",
"time": "2026-05-04T06:26:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-7669",
"datePublished": "2026-05-02T22:00:19.859Z",
"dateReserved": "2026-05-02T08:00:13.701Z",
"dateUpdated": "2026-05-05T00:31:40.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}