What’s Vulnerable › Products

SGLang vulnerabilities

41 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 41 published in the last 12 months.

Check whether your SGLang version is affected

Latest SGLang vulnerabilities

• CVE-2026-112270 — SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx (CVSS 6.5)
• CVE-2026-112269 — SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations (CVSS 6.5)
• CVE-2026-112267 — SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker (CVSS 6.5)
• CVE-2026-112266 — SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching (CVSS 5.9)
• CVE-2026-112083 — sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service (CVSS 5.3)
• CVE-2026-112082 — sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service (CVSS 7.5)
• CVE-2026-111392 — SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate (CVSS 4.8)
• CVE-2026-111391 — SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter (CVSS 8.1)
• CVE-2026-110809 — sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service (CVSS 4.3)
• CVE-2026-110807 — sgl-project SGLang generate Endpoint io_struct.py denial of service (CVSS 4.3)
• CVE-2026-109229 — SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor (CVSS 7.5)
• CVE-2026-109228 — SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters (CVSS 7.5)
• CVE-2026-109227 — SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing (CVSS 7.5)
• CVE-2026-109226 — SGLang through 0.5.21 Audio Decompression Amplification via load_audio (CVSS 7.5)
• CVE-2026-109225 — SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload (CVSS 7.5)
• CVE-2026-93034 — CVE-2026-93034 (CVSS 9.8)
• CVE-2026-105245 — sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission (CVSS 3.7)
• CVE-2026-102634 — SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room (CVSS 7.5)
• CVE-2026-94570 — CVE-2026-94570 (CVSS 5.9)
• CVE-2026-93088 — CVE-2026-93088 (CVSS 9.8)
• CVE-2026-93838 — SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx (CVSS 5.9)
• CVE-2026-93688 — SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room (CVSS 7.5)
• CVE-2026-92972 — SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint (CVSS 8.6)
• CVE-2026-86793 — CVE-2026-86793 (CVSS 9.8)
• CVE-2026-15978 — CVE-2026-15978 (CVSS 7.5)