CVE-2026-10300: SGLang Inference HTTP Endpoint lora_manager.py assertion

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-01 · updated 2026-07-22
Weakness: CWE-617

Description

A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

Affected products

SGLang: 0.5.10.post1

References

https://github.com/sgl-project/sglang/issues/23141
https://github.com/sgl-project/sglang/pull/25078
https://vuldb.com/cve/CVE-2026-10300
https://vuldb.com/submit/828086
https://vuldb.com/vuln/367593
https://vuldb.com/vuln/367593/cti

Get alerted when CVE-2026-10300 or the next vulnerability affects your stack